{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cae659a9-654a-4095-9936-d6e199661bed","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cae659a9-654a-4095-9936-d6e199661bed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cae659a9-654a-4095-9936-d6e199661bed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44572","PortSpecifier":{"PortValue":44572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b594ff8-3b44-4408-b549-a0deefa4b705","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44572","PortSpecifier":{"PortValue":44572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082024,"nanos":189539956},"http":{"id":"2b594ff8-3b44-4408-b549-a0deefa4b705","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b594ff8-3b44-4408-b549-a0deefa4b705","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44580","PortSpecifier":{"PortValue":44580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44580","PortSpecifier":{"PortValue":44580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082025,"nanos":228309048},"http":{"id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"862e2f34-4c7b-4db0-9f04-0faa6ccc3fae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef532837-0443-42d1-9f46-cf8728070749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44584","PortSpecifier":{"PortValue":44584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef532837-0443-42d1-9f46-cf8728070749","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef532837-0443-42d1-9f46-cf8728070749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44584","PortSpecifier":{"PortValue":44584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082026,"nanos":273779607},"http":{"id":"ef532837-0443-42d1-9f46-cf8728070749","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef532837-0443-42d1-9f46-cf8728070749","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef532837-0443-42d1-9f46-cf8728070749","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef532837-0443-42d1-9f46-cf8728070749","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef532837-0443-42d1-9f46-cf8728070749","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44586","PortSpecifier":{"PortValue":44586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:44586","PortSpecifier":{"PortValue":44586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082027,"nanos":311736667},"http":{"id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca72cb72-9e6b-4d00-9d35-9cdf11a68ec2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59498","PortSpecifier":{"PortValue":59498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59498","PortSpecifier":{"PortValue":59498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082028,"nanos":356669549},"http":{"id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a8e56c9b-811e-4b58-992a-8f7bf6c185a5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59500","PortSpecifier":{"PortValue":59500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59500","PortSpecifier":{"PortValue":59500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082029,"nanos":396016032},"http":{"id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5dc2d2d-493c-4ca6-9f11-4cb0ab122495","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59512","PortSpecifier":{"PortValue":59512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b64a1896-e653-493f-97a5-c5ebb90d9074","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59512","PortSpecifier":{"PortValue":59512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082030,"nanos":439371654},"http":{"id":"b64a1896-e653-493f-97a5-c5ebb90d9074","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b64a1896-e653-493f-97a5-c5ebb90d9074","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59518","PortSpecifier":{"PortValue":59518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","method":"POST","path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions","host":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:59518","PortSpecifier":{"PortValue":59518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082031,"nanos":477835493},"http":{"id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","method":"POST","headers":{":authority":"e2e-shared-a-d81393.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1aXkVaZy6q7V3MnfR_a3ghDjWWwxuc1uSBFwzVKtizXZLhwqJlPfxI1NAsYtD\"}"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","subscription":"e2e-rate-iso-a-7eed15","tenant":"e2e-shared-a-d81393","userId":"009634f3-88a5-4a9b-8eed-310240a50a08","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\",\"requestedSubscription\":\"e2e-rate-iso-a-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d81393.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"009634f3-88a5-4a9b-8eed-310240a50a08","keyName":"e2e-rate-a-7eed15","selected_subscription":"e2e-rate-iso-a-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-a-d81393/e2e-rate-iso-a-7eed15@ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-d81393/models/facebook/opt-125m","name":"rate-test-model-d81393","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7eed15","namespace":"ai-tenant-e2e-shared-a-d81393","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-d81393/rate-test-model-d81393"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ee6555f-d1df-42bf-bda9-605089aa5d17","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:36828","PortSpecifier":{"PortValue":36828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af494a16-bb23-4551-a019-116b93b8bc1c","method":"POST","path":"/ai-tenant-e2e-shared-b-976e7c/rate-test-model-976e7c/v1/completions","host":"e2e-shared-b-976e7c.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:36828","PortSpecifier":{"PortValue":36828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082031,"nanos":516226905},"http":{"id":"af494a16-bb23-4551-a019-116b93b8bc1c","method":"POST","headers":{":authority":"e2e-shared-b-976e7c.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-976e7c/rate-test-model-976e7c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1c0ZghEeTJ3vxNMJA_F0lwiKAAVFj9z6ZTw29sQDE8M8KKKqsQX2dmLc0E7J0"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-976e7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1c0ZghEeTJ3vxNMJA_F0lwiKAAVFj9z6ZTw29sQDE8M8KKKqsQX2dmLc0E7J0\"}"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-976e7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9e0ce2f4-dfdb-4e3c-ae78-faf5635d29ec","keyName":"e2e-rate-b-7eed15","subscription":"e2e-rate-iso-b-7eed15","tenant":"e2e-shared-b-976e7c","userId":"9e0ce2f4-dfdb-4e3c-ae78-faf5635d29ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-976e7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-976e7c/rate-test-model-976e7c\",\"requestedSubscription\":\"e2e-rate-iso-b-7eed15\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-976e7c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-976e7c/models/facebook/opt-125m","name":"rate-test-model-976e7c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7eed15","namespace":"ai-tenant-e2e-shared-b-976e7c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-976e7c/rate-test-model-976e7c"}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-976e7c/rate-test-model-976e7c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-976e7c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-7eed15"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9e0ce2f4-dfdb-4e3c-ae78-faf5635d29ec","keyName":"e2e-rate-b-7eed15","selected_subscription":"e2e-rate-iso-b-7eed15","selected_subscription_key":"ai-tenant-e2e-shared-b-976e7c/e2e-rate-iso-b-7eed15@ai-tenant-e2e-shared-b-976e7c/rate-test-model-976e7c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-976e7c/models/facebook/opt-125m","name":"rate-test-model-976e7c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7eed15","namespace":"ai-tenant-e2e-shared-b-976e7c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-976e7c/rate-test-model-976e7c"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:07:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af494a16-bb23-4551-a019-116b93b8bc1c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:07:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e0e7fef231a272860d16dd290f70f1d1289fd1db064a0f29b2d14ab75ae0fe4"}
{"level":"info","ts":"2026-07-26T16:07:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f31bad26c51646ac46931a007d37630dbf6429580da5c1ad0e499cf4c4e88aff"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73481033bcbd7710b9f81479f6ebeb7176912b00b12128149c1db2a57295f345"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8f41011c0f9f85b8a6285bbe222fb6c976d0925835f2164f0d7fd0523b4e052"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/010261b45c4057721fd843972b95f7c6e9c0a5a68d5f84fa0e9477c270ead839"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b224b85e0ca24ecc3e235cc0c48fa726f0a9242a35c04686c92181118335b643"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6f80447107c655bf40fc1bf48e3b3a96535b02cc519acc8837d39175314d63e1"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d754d3b4129531aa9e8e417f2e126d272d3c6dd0cca95b1fc57d22bd007fcd6"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ecb6820d68a68bc188fe70854a78bfb3b52fdc0eb0b7fd8898674b73a719e5cf"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5cb27d1b84041c0adaec7f42f2fce6a8fbe76eb742bbd29cb32f7ec1953355ed"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b93045c67bd076b073d0bedc0721494e844e42a55cdfcb39a5941940794863d"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/57c24c0c4805ae40b073e0a9003afbf9d074dff07e149c9aa7c9fc612badca79"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a480e5fb3bb0f3c26295f6ceed3b3a1042bc97eb2849fbbbe4fdc064b5024f14"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/33babc8d9f6fe163dd29f8f05faf746b1048c1e3b3563badd206593b4f963895"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a3d83d079f07d29c9fda77c5954f529334d85cdd4cb1eccd961ce15386745db2"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d50e78866bf9701f61cc10eb3ba66bf097c4517b4b2cf6aef1fea907b32fbdc"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50c09bdb25f41b2812b75e93c8e58b545974fb441aa47042da99bf9e0e3d5e15"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b36249405b44b1af6f53d295dc4988f39ebdfc1716603866c36990b6ff0fc68c"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/13000b07517f0ac049008aae056e3f077c7bec15bad76f31b365d645bac3f193"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85d0d1faa99d0bf7cb1f348f9cec76741e2ed484bc68305cdda4b2f18fea9d4b"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6972417d557b8c81556b58090dfd2468bfb68d7ffa06ae62baf179e0a2d6361b"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d3a96c10458d2c7c0cbc775fcc95015bf3db8473b0d462892be7a00cc09666b"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f14af06b1f51d61317007f1f5a3e94016bef54151b5c638f5fbb216f695b5f8"}
{"level":"info","ts":"2026-07-26T16:07:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0d4f2d17e7e2d3e3f3d8e8529b68f8ff418c32452eb1113a2fa873d3f0dda03"}
{"level":"info","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"884971f7-120e-45f4-b434-b449e396518e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43706","PortSpecifier":{"PortValue":43706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"884971f7-120e-45f4-b434-b449e396518e","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"884971f7-120e-45f4-b434-b449e396518e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43706","PortSpecifier":{"PortValue":43706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082105,"nanos":629329263},"http":{"id":"884971f7-120e-45f4-b434-b449e396518e","method":"POST","headers":{":authority":"maas.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"884971f7-120e-45f4-b434-b449e396518e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"884971f7-120e-45f4-b434-b449e396518e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f7ab8b7e-5413-4027-bb15-2c8b1490ce64","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=42e7b5fd-3242-4651-9a67-93d82a80e164"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23181f60c612"]}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"884971f7-120e-45f4-b434-b449e396518e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23181f60c612"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=42e7b5fd-3242-4651-9a67-93d82a80e164"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f7ab8b7e-5413-4027-bb15-2c8b1490ce64","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"884971f7-120e-45f4-b434-b449e396518e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"884971f7-120e-45f4-b434-b449e396518e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"884971f7-120e-45f4-b434-b449e396518e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"884971f7-120e-45f4-b434-b449e396518e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"884971f7-120e-45f4-b434-b449e396518e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"884971f7-120e-45f4-b434-b449e396518e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"884971f7-120e-45f4-b434-b449e396518e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"884971f7-120e-45f4-b434-b449e396518e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4868503-1879-492a-88ee-677e8b1899d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43712","PortSpecifier":{"PortValue":43712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f4868503-1879-492a-88ee-677e8b1899d2","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4868503-1879-492a-88ee-677e8b1899d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43712","PortSpecifier":{"PortValue":43712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082105,"nanos":704139578},"http":{"id":"f4868503-1879-492a-88ee-677e8b1899d2","method":"POST","headers":{":authority":"maas.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Fr4U4TGLsnzGZxRm_ayYGJjp60GaIhCQ77sLBj3PEQcBhE5cND0pyb7zxA3V"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Fr4U4TGLsnzGZxRm_ayYGJjp60GaIhCQ77sLBj3PEQcBhE5cND0pyb7zxA3V\"}"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"974b4cd3-30d8-4a0c-9d3a-5a938977aff1","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"974b4cd3-30d8-4a0c-9d3a-5a938977aff1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f4868503-1879-492a-88ee-677e8b1899d2","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4868503-1879-492a-88ee-677e8b1899d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"974b4cd3-30d8-4a0c-9d3a-5a938977aff1","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4868503-1879-492a-88ee-677e8b1899d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:08:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4868503-1879-492a-88ee-677e8b1899d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"}
{"level":"info","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"}
{"level":"info","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669"}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195"}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669"}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012"}
{"level":"error","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012"}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:08:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:08:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43192","PortSpecifier":{"PortValue":43192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-9a599d.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43192","PortSpecifier":{"PortValue":43192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082148,"nanos":735645820},"http":{"id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","method":"POST","headers":{":authority":"e2e-ipp-a-9a599d.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f7ab8b7e-5413-4027-bb15-2c8b1490ce64","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=42e7b5fd-3242-4651-9a67-93d82a80e164"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23181f60c612"]}}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/23181f60c612"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=42e7b5fd-3242-4651-9a67-93d82a80e164"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f7ab8b7e-5413-4027-bb15-2c8b1490ce64","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-9a599d.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-9a599d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:09:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e5a861d-519c-4507-9cb0-47cb6a416d61","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43206","PortSpecifier":{"PortValue":43206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","method":"POST","path":"/ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d/v1/chat/completions","host":"e2e-ipp-a-9a599d.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:43206","PortSpecifier":{"PortValue":43206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785082150,"nanos":802486116},"http":{"id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","method":"POST","headers":{":authority":"e2e-ipp-a-9a599d.apps.7cd49b1d-f058-4cbd-8937-23181f60c612.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PXQXCOzJsjkElzyq_edmLI2MUmEdHMYDKUhWLDmSCKxcxu0r1gTPsfQk25Sv"}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-9a599d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PXQXCOzJsjkElzyq_edmLI2MUmEdHMYDKUhWLDmSCKxcxu0r1gTPsfQk25Sv\"}"}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-9a599d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8bcaee48-1a81-4eb0-b4f3-ee5f27f9b4ab","keyName":"e2e-ipp-9a599d","subscription":"ipp-route-9a599d-sub","tenant":"e2e-ipp-a-9a599d","userId":"8bcaee48-1a81-4eb0-b4f3-ee5f27f9b4ab","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-9a599d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d\",\"requestedSubscription\":\"ipp-route-9a599d-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-9a599d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-9a599d/models/facebook/opt-125m","name":"ipp-route-9a599d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-9a599d-sub","namespace":"ai-tenant-e2e-ipp-a-9a599d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d"}}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-9a599d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-9a599d-sub"}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8bcaee48-1a81-4eb0-b4f3-ee5f27f9b4ab","keyName":"e2e-ipp-9a599d","selected_subscription":"ipp-route-9a599d-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d-sub@ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-9a599d/models/facebook/opt-125m","name":"ipp-route-9a599d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-9a599d-sub","namespace":"ai-tenant-e2e-ipp-a-9a599d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-9a599d/ipp-route-9a599d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:09:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ba14f82-a555-46fb-86c0-ea8d5950c4a8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/960539b676ef60ce78ee569e66c2dbec9cb7ba39709d432f2c3114823b5f81e1"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7a9619e235478b32f5841cbeb463310a867cc2cb087a05fdbe95be3d6f1f1012"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d9e9b705f33aa5e1c7da4a4e8ecdb3194a2f668e729f11dc4734184fe739d0e2"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/93c88c17268f5912ff1301f9df866e896c0317754e7c94fc69a9853c116e1574"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/905d08490629988649569abe06b6fc30d9566c92a73c39b809ad1f9fbdd83bfb"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/09fa5f298a1a4962e678c8d5dcdae6cc7464f298d7f423ef614cf1db2f779195"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3541c0a9facfa436d680c79f35d74a95749432724564041fb131b9927315da43"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/049b9d1fb5f44f8fa9b5be4f55107fd1e25bb8e0c7644d1e926fcf8abbc6b669"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56352cc51fa2e2b893b94f2a9159e489472d8745626fdda9efacf93e3023da99"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/906b6f9b4f15e780272c9aac326ef872186e1eb91b03a0d50ad9b607a5e67097"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f13fa318fea6209671adedb4ada2d67cadb891aa5edb809d87458b490b4ca63c"}
{"level":"info","ts":"2026-07-26T16:10:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a9a290f00329cde221c4623f67e799e4c97e6574b5020ccfac2eb24728d7858"}