{"level":"debug","ts":"2026-07-11T04:33:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4c8e7f3-4cdb-49be-8431-5fcb415ef0c2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4c8e7f3-4cdb-49be-8431-5fcb415ef0c2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4c8e7f3-4cdb-49be-8431-5fcb415ef0c2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4c8e7f3-4cdb-49be-8431-5fcb415ef0c2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4c8e7f3-4cdb-49be-8431-5fcb415ef0c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4c8e7f3-4cdb-49be-8431-5fcb415ef0c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4c8e7f3-4cdb-49be-8431-5fcb415ef0c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52598","PortSpecifier":{"PortValue":52598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52598","PortSpecifier":{"PortValue":52598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744405,"nanos":953016826},"http":{"id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76e2e573-0688-4145-8b81-6098e5bb0ef9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52614","PortSpecifier":{"PortValue":52614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"701bd107-ea3f-46f0-8806-920262ae5dcd","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52614","PortSpecifier":{"PortValue":52614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744406,"nanos":988150048},"http":{"id":"701bd107-ea3f-46f0-8806-920262ae5dcd","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"701bd107-ea3f-46f0-8806-920262ae5dcd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52620","PortSpecifier":{"PortValue":52620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52620","PortSpecifier":{"PortValue":52620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744408,"nanos":28528107},"http":{"id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f7a4cee-e01a-4c6d-ad8a-23e60e4385f7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52628","PortSpecifier":{"PortValue":52628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:52628","PortSpecifier":{"PortValue":52628}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744409,"nanos":71751150},"http":{"id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b63fcea-a10b-4da7-838a-5210a08f7ea8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49196","PortSpecifier":{"PortValue":49196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9fc0403b-2913-41e9-9103-39c437cf497c","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49196","PortSpecifier":{"PortValue":49196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744410,"nanos":105885974},"http":{"id":"9fc0403b-2913-41e9-9103-39c437cf497c","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fc0403b-2913-41e9-9103-39c437cf497c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49210","PortSpecifier":{"PortValue":49210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49210","PortSpecifier":{"PortValue":49210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744411,"nanos":141991284},"http":{"id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cf4b569-61d0-46bc-b1f6-29dd20abe2d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49220","PortSpecifier":{"PortValue":49220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49220","PortSpecifier":{"PortValue":49220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744412,"nanos":182322898},"http":{"id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abaef5a8-03c9-95c6-adb2-cda520ed448d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49236","PortSpecifier":{"PortValue":49236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"82fbb84e-4f79-4480-ae1d-f242c893c582","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49236","PortSpecifier":{"PortValue":49236}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744413,"nanos":221173727},"http":{"id":"82fbb84e-4f79-4480-ae1d-f242c893c582","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82fbb84e-4f79-4480-ae1d-f242c893c582","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49238","PortSpecifier":{"PortValue":49238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49238","PortSpecifier":{"PortValue":49238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744414,"nanos":258426956},"http":{"id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7267d4d5-cf03-446a-849d-0cf1ae1a1699","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"58b17372-4742-4fb2-a53c-b39242926b60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49242","PortSpecifier":{"PortValue":49242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"58b17372-4742-4fb2-a53c-b39242926b60","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"58b17372-4742-4fb2-a53c-b39242926b60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49242","PortSpecifier":{"PortValue":49242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744415,"nanos":295396848},"http":{"id":"58b17372-4742-4fb2-a53c-b39242926b60","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17idZFHkiJzSlTeFS_vkRRSXCgQ9kqFscZdKlMMF42uT2xjT8tWCZPNQwM67u\"}"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","subscription":"e2e-rate-iso-a-b6ee37","tenant":"e2e-shared-a-3055d9","userId":"6f5b9339-79ad-4a26-a665-67770ff35898","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-b6ee37\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"58b17372-4742-4fb2-a53c-b39242926b60","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"58b17372-4742-4fb2-a53c-b39242926b60","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"58b17372-4742-4fb2-a53c-b39242926b60","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6ee37"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"58b17372-4742-4fb2-a53c-b39242926b60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6f5b9339-79ad-4a26-a665-67770ff35898","keyName":"e2e-rate-a-b6ee37","selected_subscription":"e2e-rate-iso-a-b6ee37","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-b6ee37@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6ee37","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"58b17372-4742-4fb2-a53c-b39242926b60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"58b17372-4742-4fb2-a53c-b39242926b60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39588","PortSpecifier":{"PortValue":39588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2230e315-a4ad-4def-a63e-b92899e684b8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39588","PortSpecifier":{"PortValue":39588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744424,"nanos":396932},"http":{"id":"2230e315-a4ad-4def-a63e-b92899e684b8","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c1f5cefd-2981-40c6-b179-b5930462382d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8beca4c3-3fc4-47e0-b105-a9abd12314f6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87ff76ea6eef"]}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87ff76ea6eef"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8beca4c3-3fc4-47e0-b105-a9abd12314f6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c1f5cefd-2981-40c6-b179-b5930462382d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6f886726bbdb7dc185d587a42f8d970d050b10ee0c4ec1ef2654e0ba0e73f400"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2230e315-a4ad-4def-a63e-b92899e684b8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d83616b-a431-46d7-910b-b66066078c6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58084","PortSpecifier":{"PortValue":58084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d83616b-a431-46d7-910b-b66066078c6a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-eefca5.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d83616b-a431-46d7-910b-b66066078c6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58084","PortSpecifier":{"PortValue":58084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744424,"nanos":41353667},"http":{"id":"2d83616b-a431-46d7-910b-b66066078c6a","method":"POST","headers":{":authority":"e2e-shared-b-eefca5.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2d83616b-a431-46d7-910b-b66066078c6a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d83616b-a431-46d7-910b-b66066078c6a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c1f5cefd-2981-40c6-b179-b5930462382d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8beca4c3-3fc4-47e0-b105-a9abd12314f6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87ff76ea6eef"]}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d83616b-a431-46d7-910b-b66066078c6a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/87ff76ea6eef"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8beca4c3-3fc4-47e0-b105-a9abd12314f6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c1f5cefd-2981-40c6-b179-b5930462382d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b9cdbed2ec1dca8284668768cc6b8196114a31c4863b2e50ef9effac96b68152"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.62:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-eefca5.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d83616b-a431-46d7-910b-b66066078c6a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d83616b-a431-46d7-910b-b66066078c6a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"2d83616b-a431-46d7-910b-b66066078c6a","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d83616b-a431-46d7-910b-b66066078c6a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-b-eefca5/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2d83616b-a431-46d7-910b-b66066078c6a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d83616b-a431-46d7-910b-b66066078c6a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d83616b-a431-46d7-910b-b66066078c6a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d83616b-a431-46d7-910b-b66066078c6a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d83616b-a431-46d7-910b-b66066078c6a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39590","PortSpecifier":{"PortValue":39590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39590","PortSpecifier":{"PortValue":39590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744424,"nanos":79990930},"http":{"id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"568f73b3-35d4-438b-8dc8-fbf78711fbbd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39596","PortSpecifier":{"PortValue":39596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39596","PortSpecifier":{"PortValue":39596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744425,"nanos":113639892},"http":{"id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1bccf22-faec-476b-88c5-2a0b2a41a9da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39612","PortSpecifier":{"PortValue":39612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39612","PortSpecifier":{"PortValue":39612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744426,"nanos":154776398},"http":{"id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4feb8ada-b60b-4ba4-8019-57c8c757b0bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39622","PortSpecifier":{"PortValue":39622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39622","PortSpecifier":{"PortValue":39622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744427,"nanos":189369827},"http":{"id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"278d43ff-b4c4-4091-bd7b-9b9b3fac9c93","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39626","PortSpecifier":{"PortValue":39626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1060c8a2-7350-4bf0-8f30-c171994465a8","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39626","PortSpecifier":{"PortValue":39626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744428,"nanos":227854793},"http":{"id":"1060c8a2-7350-4bf0-8f30-c171994465a8","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1060c8a2-7350-4bf0-8f30-c171994465a8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39632","PortSpecifier":{"PortValue":39632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:39632","PortSpecifier":{"PortValue":39632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744429,"nanos":265818403},"http":{"id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddd0f72e-83d5-4d36-84dd-c41aaebeda57","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57502","PortSpecifier":{"PortValue":57502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be013234-3933-4962-a9d3-bfa9b316d7a1","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57502","PortSpecifier":{"PortValue":57502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744430,"nanos":300935702},"http":{"id":"be013234-3933-4962-a9d3-bfa9b316d7a1","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be013234-3933-4962-a9d3-bfa9b316d7a1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57504","PortSpecifier":{"PortValue":57504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57504","PortSpecifier":{"PortValue":57504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744431,"nanos":337283619},"http":{"id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2afe75fa-3487-4e57-8027-eaaa347b55ad","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57516","PortSpecifier":{"PortValue":57516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57516","PortSpecifier":{"PortValue":57516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744432,"nanos":371505984},"http":{"id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99e404ae-1dc5-403b-9f02-9be36ec1c2e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57524","PortSpecifier":{"PortValue":57524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","method":"POST","path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions","host":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57524","PortSpecifier":{"PortValue":57524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744433,"nanos":407665016},"http":{"id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","method":"POST","headers":{":authority":"e2e-shared-a-3055d9.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bWCPm9n1bJcHPXFk_jgjmWkY0ybv58cdEmaODR6Xlwws8ugcuwOM2LIJYih9\"}"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","subscription":"e2e-rate-iso-a-3cdf57","tenant":"e2e-shared-a-3055d9","userId":"75d3996f-e078-487c-b322-4079eee02fec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\",\"requestedSubscription\":\"e2e-rate-iso-a-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 222, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3055d9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-a-3055d9/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d3996f-e078-487c-b322-4079eee02fec","keyName":"e2e-rate-a-3cdf57","selected_subscription":"e2e-rate-iso-a-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-a-3055d9/e2e-rate-iso-a-3cdf57@ai-tenant-e2e-shared-a-3055d9/rate-test-model-3055d9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3055d9","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3cdf57","namespace":"ai-tenant-e2e-shared-a-3055d9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26b56d78-1b34-4f17-8f9c-0c9a91bd6011","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"369bac94-ce39-400a-a328-349e8a961570","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:60840","PortSpecifier":{"PortValue":60840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"369bac94-ce39-400a-a328-349e8a961570","method":"POST","path":"/ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5/v1/completions","host":"e2e-shared-b-eefca5.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"369bac94-ce39-400a-a328-349e8a961570","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:60840","PortSpecifier":{"PortValue":60840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783744433,"nanos":444025367},"http":{"id":"369bac94-ce39-400a-a328-349e8a961570","method":"POST","headers":{":authority":"e2e-shared-b-eefca5.apps.d5cd2825-e7ab-4952-bcf4-87ff76ea6eef.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Qv49dkBlwXpDS15z_NuwlfTs5xp9hYp3neRrvghJq1QkKmcp2SUOhjk98QrE"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"369bac94-ce39-400a-a328-349e8a961570","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-eefca5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Qv49dkBlwXpDS15z_NuwlfTs5xp9hYp3neRrvghJq1QkKmcp2SUOhjk98QrE\"}"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-eefca5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e8e6aaeb-1453-4d41-a6cd-f47da31f6b04","keyName":"e2e-rate-b-3cdf57","subscription":"e2e-rate-iso-b-3cdf57","tenant":"e2e-shared-b-eefca5","userId":"e8e6aaeb-1453-4d41-a6cd-f47da31f6b04","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"369bac94-ce39-400a-a328-349e8a961570","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-eefca5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5\",\"requestedSubscription\":\"e2e-rate-iso-b-3cdf57\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"unable to store data in the cache","request id":"369bac94-ce39-400a-a328-349e8a961570","config":"subscription-info","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 224, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-eefca5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-eefca5","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-3cdf57","namespace":"ai-tenant-e2e-shared-b-eefca5","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"369bac94-ce39-400a-a328-349e8a961570","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"369bac94-ce39-400a-a328-349e8a961570","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\npublisher_to_identity := {\"publishers/ai-tenant-e2e-shared-b-eefca5/models/facebook/opt-125m\":\"ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5\"}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := publisher_to_identity[raw_header_model_identity] {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"unable to store data in the cache","request id":"369bac94-ce39-400a-a328-349e8a961570","err":"size of key: ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? (request.headers[\"x-gateway-model-name\"] in  ? [request.headers[\"x-gateway-model-name\"]] : request.headers[\"x-gateway-model-name\"])     : request.headers[\"x-gateway-model-name\"])   : \"\")), value: 14, err: The entry size is larger than 1/1024 of cache size"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-3cdf57"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369bac94-ce39-400a-a328-349e8a961570","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e8e6aaeb-1453-4d41-a6cd-f47da31f6b04","keyName":"e2e-rate-b-3cdf57","selected_subscription":"e2e-rate-iso-b-3cdf57","selected_subscription_key":"ai-tenant-e2e-shared-b-eefca5/e2e-rate-iso-b-3cdf57@ai-tenant-e2e-shared-b-eefca5/rate-test-model-eefca5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-eefca5","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-3cdf57","namespace":"ai-tenant-e2e-shared-b-eefca5","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"369bac94-ce39-400a-a328-349e8a961570","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-11T04:33:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"369bac94-ce39-400a-a328-349e8a961570","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ec44c232cd4244a485073415932541548a5a60ab40f61079a9092a45b91c35e"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/270fc7ebe90309928895a5fa4e55f3d50997c7479ea66ac22f489e30c4a0bf6b"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d0e58cbccd7f5b2fb1b75f4bc77b764d813a92d9e57deb7e2cb3a589d528a3b"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a98a4bf3a44244b68db64970ee4e2cef139d624b69dcdeecbe09a3c90779687b"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/959addcba443c6e4dbf46fd69c5884523e86cf49744820895876d9ff6fc2a0d2"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/79d172dee9a791005649dc6afa2d2d168a02b1840a94326994881221420a4f9d"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f8c19b0553a468bc107880e421142f87d214f7ef282c7cef8a78d6e9e1031ceb"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/838f2e476e63218ec237536d62d2bb50716b11cdcc658980904992c7a96adc1b"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f090e609218625e03878289566695620ecf972a74d79ca6e5e950e1e5a601ca6"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2be1b18ff96fe7e9fb308ac850cb9608e7f657ee11978b9f0f25ff2b496bde4e"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ba990cdd29ff7416154f190a77a22ec6d963d762814d747743faf7da99ee5bb3"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f8a0bc48f5e4838b464fae934b8dec8ec6feb4cadea8c18b51da631b5996943b"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd3bcc91ac6ccf78e2701851155b000a8008b160d0b90e6f021581b914e25bb6"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4c780fb9acbd5e130ed6c5871e65d358d42eb95b346ebce1a992129a2389912"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/191090ab9fdb1a9adffc5a85f0859fccd80553586148d0858aa291030a3c1316"}
{"level":"info","ts":"2026-07-11T04:34:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2825fec5bbeb2da892a262e9cbd0ed2c9b24cdf8b3dc058fd48a20edbe3aaf07"}
{"level":"info","ts":"2026-07-11T04:34:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9817fe84076f4d510281346e6db29bf2b48e6eea0cdeed2c208ce998e3a0df80"}
{"level":"info","ts":"2026-07-11T04:34:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d475d146080b913d027ab247ddee918b52b9c4efdbd84d42edcba388b55d612"}
{"level":"info","ts":"2026-07-11T04:34:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/04e360888aa9d53033f060770534019e052fa58fac45f24a3b9516413822c993"}
{"level":"info","ts":"2026-07-11T04:34:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6f886726bbdb7dc185d587a42f8d970d050b10ee0c4ec1ef2654e0ba0e73f400"}
{"level":"info","ts":"2026-07-11T04:34:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8457d2140061893f0e24ca3616093a429a6b97b8bda78af2160c70ca205ecef9"}
{"level":"info","ts":"2026-07-11T04:34:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9cdbed2ec1dca8284668768cc6b8196114a31c4863b2e50ef9effac96b68152"}
{"level":"info","ts":"2026-07-11T04:34:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f8d8f542506c405fece3164d45241f02107ea1755b0d1cfc2610d4590864990f"}
{"level":"info","ts":"2026-07-11T04:34:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f188a03b6308b7b3d82260abe6030d27a8c88a02e724dd4327817f91a154be42"}