{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6fe50b6-1153-41a3-9d93-446826038451","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c4039e89c2c53a6336eca80effad73db2cdd22960768b7ff3a157f1237cf55ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-70aa40.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-70aa40/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2390195-4cac-4c0e-a2e2-d95f3e512285","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54424","PortSpecifier":{"PortValue":54424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54424","PortSpecifier":{"PortValue":54424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785181986,"nanos":728867870},"http":{"id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-elXU9rTiVrz4jtPn_ISGEfgY1RmNkF6Tu6dVSlUb1IULWsXqasfkWjPpGdXM"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-elXU9rTiVrz4jtPn_ISGEfgY1RmNkF6Tu6dVSlUb1IULWsXqasfkWjPpGdXM\"}"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","keyName":"e2e-rate-a-ef5c7c","subscription":"e2e-rate-iso-a-ef5c7c","tenant":"e2e-shared-a-b4cd12","userId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-ef5c7c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ef5c7c","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ef5c7c"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","keyName":"e2e-rate-a-ef5c7c","selected_subscription":"e2e-rate-iso-a-ef5c7c","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-ef5c7c@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ef5c7c","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87de577e-6bf0-4d2d-9c64-b1ebdf694ef9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54438","PortSpecifier":{"PortValue":54438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54438","PortSpecifier":{"PortValue":54438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785181987,"nanos":818336713},"http":{"id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-elXU9rTiVrz4jtPn_ISGEfgY1RmNkF6Tu6dVSlUb1IULWsXqasfkWjPpGdXM"}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-elXU9rTiVrz4jtPn_ISGEfgY1RmNkF6Tu6dVSlUb1IULWsXqasfkWjPpGdXM\"}"}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","keyName":"e2e-rate-a-ef5c7c","subscription":"e2e-rate-iso-a-ef5c7c","tenant":"e2e-shared-a-b4cd12","userId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-ef5c7c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ef5c7c","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ef5c7c"}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","keyName":"e2e-rate-a-ef5c7c","selected_subscription":"e2e-rate-iso-a-ef5c7c","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-ef5c7c@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ef5c7c","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72bd8f16-22a4-4c7b-bfa8-59d1964b76f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54454","PortSpecifier":{"PortValue":54454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea6199db-6557-4de3-96d9-fa72921a0724","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:54454","PortSpecifier":{"PortValue":54454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785181988,"nanos":862513697},"http":{"id":"ea6199db-6557-4de3-96d9-fa72921a0724","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-elXU9rTiVrz4jtPn_ISGEfgY1RmNkF6Tu6dVSlUb1IULWsXqasfkWjPpGdXM"}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-elXU9rTiVrz4jtPn_ISGEfgY1RmNkF6Tu6dVSlUb1IULWsXqasfkWjPpGdXM\"}"}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","keyName":"e2e-rate-a-ef5c7c","subscription":"e2e-rate-iso-a-ef5c7c","tenant":"e2e-shared-a-b4cd12","userId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-ef5c7c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ef5c7c","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ef5c7c"}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c08889e4-8b0f-483c-b2e3-4ad82ca512ae","keyName":"e2e-rate-a-ef5c7c","selected_subscription":"e2e-rate-iso-a-ef5c7c","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-ef5c7c@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ef5c7c","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea6199db-6557-4de3-96d9-fa72921a0724","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50320","PortSpecifier":{"PortValue":50320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"842d8a11-dfc7-467c-adab-62cd39630cc7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50320","PortSpecifier":{"PortValue":50320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182010,"nanos":241060342},"http":{"id":"842d8a11-dfc7-467c-adab-62cd39630cc7","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6fe50b6-1153-41a3-9d93-446826038451","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"]}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6fe50b6-1153-41a3-9d93-446826038451","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d01a57977b0312a7d87e67c5c59b2a2b12614b5e0d255dac312b2e5c682bbad5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.101:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"842d8a11-dfc7-467c-adab-62cd39630cc7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50244","PortSpecifier":{"PortValue":50244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-70aa40.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50244","PortSpecifier":{"PortValue":50244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182010,"nanos":282829916},"http":{"id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","method":"POST","headers":{":authority":"e2e-shared-b-70aa40.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6fe50b6-1153-41a3-9d93-446826038451","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"]}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6fe50b6-1153-41a3-9d93-446826038451","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c4039e89c2c53a6336eca80effad73db2cdd22960768b7ff3a157f1237cf55ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-70aa40.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-70aa40/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffd7f440-82f1-47f5-850f-7e5f046f4b1f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50324","PortSpecifier":{"PortValue":50324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f859996f-b18d-47d3-846d-9cf840ca07c9","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50324","PortSpecifier":{"PortValue":50324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182010,"nanos":320051660},"http":{"id":"f859996f-b18d-47d3-846d-9cf840ca07c9","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J\"}"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","subscription":"e2e-rate-iso-a-586808","tenant":"e2e-shared-a-b4cd12","userId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-586808\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-586808"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","selected_subscription":"e2e-rate-iso-a-586808","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-586808@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f859996f-b18d-47d3-846d-9cf840ca07c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50326","PortSpecifier":{"PortValue":50326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89ad24f3-2840-418f-9820-1a56666dbdd6","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50326","PortSpecifier":{"PortValue":50326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182011,"nanos":361064877},"http":{"id":"89ad24f3-2840-418f-9820-1a56666dbdd6","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J"}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J\"}"}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","subscription":"e2e-rate-iso-a-586808","tenant":"e2e-shared-a-b4cd12","userId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-586808\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-586808"}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","selected_subscription":"e2e-rate-iso-a-586808","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-586808@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89ad24f3-2840-418f-9820-1a56666dbdd6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97c760bc-be55-4480-968f-091aadba251f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50338","PortSpecifier":{"PortValue":50338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97c760bc-be55-4480-968f-091aadba251f","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97c760bc-be55-4480-968f-091aadba251f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50338","PortSpecifier":{"PortValue":50338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182012,"nanos":402886896},"http":{"id":"97c760bc-be55-4480-968f-091aadba251f","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J"}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97c760bc-be55-4480-968f-091aadba251f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J\"}"}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","subscription":"e2e-rate-iso-a-586808","tenant":"e2e-shared-a-b4cd12","userId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97c760bc-be55-4480-968f-091aadba251f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-586808\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97c760bc-be55-4480-968f-091aadba251f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-586808"}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c760bc-be55-4480-968f-091aadba251f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","selected_subscription":"e2e-rate-iso-a-586808","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-586808@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97c760bc-be55-4480-968f-091aadba251f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97c760bc-be55-4480-968f-091aadba251f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50348","PortSpecifier":{"PortValue":50348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50348","PortSpecifier":{"PortValue":50348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182013,"nanos":441133260},"http":{"id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J"}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J\"}"}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","subscription":"e2e-rate-iso-a-586808","tenant":"e2e-shared-a-b4cd12","userId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-586808\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-586808"}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","selected_subscription":"e2e-rate-iso-a-586808","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-586808@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af4e39ce-5777-4f3f-8101-15cc26d6d10d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50360","PortSpecifier":{"PortValue":50360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50360","PortSpecifier":{"PortValue":50360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182014,"nanos":481504525},"http":{"id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J"}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J\"}"}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","subscription":"e2e-rate-iso-a-586808","tenant":"e2e-shared-a-b4cd12","userId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-586808\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-586808"}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","selected_subscription":"e2e-rate-iso-a-586808","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-586808@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e188ca9-7a42-42f4-9464-ec092f5c3be9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50376","PortSpecifier":{"PortValue":50376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"977506a0-3a6a-46af-b70a-f3797818d14f","method":"POST","path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions","host":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50376","PortSpecifier":{"PortValue":50376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.101:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182015,"nanos":520979575},"http":{"id":"977506a0-3a6a-46af-b70a-f3797818d14f","method":"POST","headers":{":authority":"e2e-shared-a-b4cd12.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MnFE4cKkzpbm4EEr_F0iJtp3dSioxjtadMmzuTLCXAqJ68guWz2nCO6Vr33J\"}"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","subscription":"e2e-rate-iso-a-586808","tenant":"e2e-shared-a-b4cd12","userId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\",\"requestedSubscription\":\"e2e-rate-iso-a-586808\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b4cd12.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-586808"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc0daef3-4f5c-4f20-9e32-f672d0c702fc","keyName":"e2e-rate-a-586808","selected_subscription":"e2e-rate-iso-a-586808","selected_subscription_key":"ai-tenant-e2e-shared-a-b4cd12/e2e-rate-iso-a-586808@ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-b4cd12/models/facebook/opt-125m","name":"rate-test-model-b4cd12","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-586808","namespace":"ai-tenant-e2e-shared-a-b4cd12","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b4cd12/rate-test-model-b4cd12"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"977506a0-3a6a-46af-b70a-f3797818d14f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50252","PortSpecifier":{"PortValue":50252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3cac1622-ee61-422a-aa9f-c774e007043d","method":"POST","path":"/ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40/v1/completions","host":"e2e-shared-b-70aa40.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:50252","PortSpecifier":{"PortValue":50252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182015,"nanos":558058065},"http":{"id":"3cac1622-ee61-422a-aa9f-c774e007043d","method":"POST","headers":{":authority":"e2e-shared-b-70aa40.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8JlNJzoukJxh618N_9v7HhIt9qJZVkacQTvkBz9gSu4qA6sRpdfwLrOAkCrl"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-70aa40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8JlNJzoukJxh618N_9v7HhIt9qJZVkacQTvkBz9gSu4qA6sRpdfwLrOAkCrl\"}"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-70aa40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2bf37db1-ab96-4af4-a4e7-b6c849d309bd","keyName":"e2e-rate-b-586808","subscription":"e2e-rate-iso-b-586808","tenant":"e2e-shared-b-70aa40","userId":"2bf37db1-ab96-4af4-a4e7-b6c849d309bd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-70aa40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40\",\"requestedSubscription\":\"e2e-rate-iso-b-586808\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-70aa40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-70aa40/models/facebook/opt-125m","name":"rate-test-model-70aa40","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-586808","namespace":"ai-tenant-e2e-shared-b-70aa40","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40"}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-70aa40/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-586808"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2bf37db1-ab96-4af4-a4e7-b6c849d309bd","keyName":"e2e-rate-b-586808","selected_subscription":"e2e-rate-iso-b-586808","selected_subscription_key":"ai-tenant-e2e-shared-b-70aa40/e2e-rate-iso-b-586808@ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-70aa40/models/facebook/opt-125m","name":"rate-test-model-70aa40","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-586808","namespace":"ai-tenant-e2e-shared-b-70aa40","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-70aa40/rate-test-model-70aa40"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:53:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3cac1622-ee61-422a-aa9f-c774e007043d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/74a329e9f7d20ae5975acbb740b41133284d754328fc35d072427a99e005f7e8"}
{"level":"info","ts":"2026-07-27T19:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5a0719ccf03490ba083c5a85f6917bbf631d64f1a0b73062bbe3fb70a36629cf"}
{"level":"info","ts":"2026-07-27T19:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b2e67ccd070d86c0d85009f008d496fb21d0f2aa5a2bfd15eba6be026978794"}
{"level":"info","ts":"2026-07-27T19:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18d3fac9e653661319dfdde8f13185d9d692feaefc70c23ca8156a65fe953aa8"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/12bd5c222517715f0c83accee10bdf1a3c0aba760b3e64be816eeadef88422fe"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d6e42824e4e724373aa25f9ea871ce85e89422dc3093eda5e09b5762f866e92d"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/45935889556e840f4faba0a5e5eea023f498589cb68c27966355dceb3822cd78"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c8bb7fe6875f226ebfe7597af3d1fd53c7c7cecefca6149ed834db136796121"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e58511acfa19f38e953b338e55059e470003a63397ebe72e444d513eec290d55"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/57a118318e777a77a93841cf0d4894f82675daac3a152e1a2007f67603c63587"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4205971c6efeadc90eb94ded8636766ad966bff37db593fa5c82376bb2f93760"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a57edc99528d2fdbdafc48fe950ddad98cbc3017ed8e0e0b0710be864f27575"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/65437045d139f6cd63d9189e376ee4d7090de0c6d0e9b10f460322f1653426d6"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c584f08063b2403af36171aba708cf211b3f027c288225c28c59fd65b516a730"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d01a57977b0312a7d87e67c5c59b2a2b12614b5e0d255dac312b2e5c682bbad5"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c20d87ea0477733385d07bdc3bc324496fe9d29bcb0a3c38228517e8b9c8e830"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99a2edea735fe3bc4149b532e679922f8d614417c93396152d6e75678a5d4700"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c4039e89c2c53a6336eca80effad73db2cdd22960768b7ff3a157f1237cf55ae"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/adb6a587b8fef55bf187b117b575909e84e4a214f92677dda04df12235019940"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f3b49b3b6ba8a942a1ff110fca545d3451d57874c02c114182fc189de1499cce"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa7a0b139a0402ed5da7bc1b29fee74bc431693846b9dc3b0b7d03305b2c15e4"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7b6ad4c50fc2d8fcbd7c08949db2cdeb99620d0fc608d46d299cfb431c17ecd"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/198a923c5ad2fe059ff248b60d6c979985dd20d4ca3bd82a0007e2c9f09023a1"}
{"level":"info","ts":"2026-07-27T19:53:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56cb4039fc25e72f81bd0cd722bff923f418c47f6e8e78b06e70acbe308c3176"}
{"level":"info","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49554","PortSpecifier":{"PortValue":49554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.22:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49554","PortSpecifier":{"PortValue":49554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.22:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182089,"nanos":617376741},"http":{"id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","method":"POST","headers":{":authority":"maas.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6fe50b6-1153-41a3-9d93-446826038451","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"]}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6fe50b6-1153-41a3-9d93-446826038451","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.22:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d097c1ee-93ba-44df-8e22-153c460fc6a0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49560","PortSpecifier":{"PortValue":49560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.22:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:49560","PortSpecifier":{"PortValue":49560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.22:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182089,"nanos":674318642},"http":{"id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","method":"POST","headers":{":authority":"maas.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ozsk661r4l8RcdpK_HfOM44WWCgiM6VGXAHicyT5OZdcK3AdYAM3cMZOlkZv"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ozsk661r4l8RcdpK_HfOM44WWCgiM6VGXAHicyT5OZdcK3AdYAM3cMZOlkZv\"}"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73723aaa-99a6-4a79-8e7e-52e7fdd3327e","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"73723aaa-99a6-4a79-8e7e-52e7fdd3327e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.22:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73723aaa-99a6-4a79-8e7e-52e7fdd3327e","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:54:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e661d2e7-b7bb-420a-a1ec-848f9f9239ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2"}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"error","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b"}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b"}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cfadf22e8f14d164ddd696c28359106418dcb90206f6d063c2be628a5441535c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cfadf22e8f14d164ddd696c28359106418dcb90206f6d063c2be628a5441535c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cfadf22e8f14d164ddd696c28359106418dcb90206f6d063c2be628a5441535c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cfadf22e8f14d164ddd696c28359106418dcb90206f6d063c2be628a5441535c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cfadf22e8f14d164ddd696c28359106418dcb90206f6d063c2be628a5441535c"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cfadf22e8f14d164ddd696c28359106418dcb90206f6d063c2be628a5441535c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192"}
{"level":"info","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af9800ce037fcaa1e233e538b4b43bbb698bd705a261a79aa04f4aff4fbfb498"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"af9800ce037fcaa1e233e538b4b43bbb698bd705a261a79aa04f4aff4fbfb498","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["af9800ce037fcaa1e233e538b4b43bbb698bd705a261a79aa04f4aff4fbfb498"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b5b7c310d9d8af5bca04a818e269b758c5b0b59076bd84c38fa0b48f21fb9ae"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"af9800ce037fcaa1e233e538b4b43bbb698bd705a261a79aa04f4aff4fbfb498","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2b5b7c310d9d8af5bca04a818e269b758c5b0b59076bd84c38fa0b48f21fb9ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2b5b7c310d9d8af5bca04a818e269b758c5b0b59076bd84c38fa0b48f21fb9ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2b5b7c310d9d8af5bca04a818e269b758c5b0b59076bd84c38fa0b48f21fb9ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/af9800ce037fcaa1e233e538b4b43bbb698bd705a261a79aa04f4aff4fbfb498"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b5b7c310d9d8af5bca04a818e269b758c5b0b59076bd84c38fa0b48f21fb9ae"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"af9800ce037fcaa1e233e538b4b43bbb698bd705a261a79aa04f4aff4fbfb498","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b5b7c310d9d8af5bca04a818e269b758c5b0b59076bd84c38fa0b48f21fb9ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:55:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:55:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59298","PortSpecifier":{"PortValue":59298}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.111:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-f227a8.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59298","PortSpecifier":{"PortValue":59298}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.111:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182143,"nanos":18111386},"http":{"id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","method":"POST","headers":{":authority":"e2e-ipp-a-f227a8.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"d6fe50b6-1153-41a3-9d93-446826038451","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"]}}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/35e388f614b5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=907eb61e-2a26-47a1-b06a-105596630d39"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"d6fe50b6-1153-41a3-9d93-446826038451","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.111:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-f227a8.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-f227a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:55:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01abb376-3515-4ffc-8cd5-00646d3ca51c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59312","PortSpecifier":{"PortValue":59312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.111:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","method":"POST","path":"/ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8/v1/chat/completions","host":"e2e-ipp-a-f227a8.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59312","PortSpecifier":{"PortValue":59312}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.111:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785182145,"nanos":92759961},"http":{"id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","method":"POST","headers":{":authority":"e2e-ipp-a-f227a8.apps.80e421a9-0d89-40fd-a311-35e388f614b5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-qeWDBA2W1JTN7wiz_oyOsPdhAiCdGsZIRRsTmEv6RFKRDjDRUiQDktjIGl6K"}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-f227a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-qeWDBA2W1JTN7wiz_oyOsPdhAiCdGsZIRRsTmEv6RFKRDjDRUiQDktjIGl6K\"}"}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-f227a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7514c5b6-7f53-4920-9879-9bab0ff3e88e","keyName":"e2e-ipp-f227a8","subscription":"ipp-route-f227a8-sub","tenant":"e2e-ipp-a-f227a8","userId":"7514c5b6-7f53-4920-9879-9bab0ff3e88e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-f227a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8\",\"requestedSubscription\":\"ipp-route-f227a8-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-f227a8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-f227a8/models/facebook/opt-125m","name":"ipp-route-f227a8","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-f227a8-sub","namespace":"ai-tenant-e2e-ipp-a-f227a8","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8"}}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-f227a8/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-f227a8-sub"}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7514c5b6-7f53-4920-9879-9bab0ff3e88e","keyName":"e2e-ipp-f227a8","selected_subscription":"ipp-route-f227a8-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8-sub@ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-f227a8/models/facebook/opt-125m","name":"ipp-route-f227a8","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-f227a8-sub","namespace":"ai-tenant-e2e-ipp-a-f227a8","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-f227a8/ipp-route-f227a8"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45fa5c3e-50e0-4add-b5b6-2aa7bf61ff2f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/20474a3d222055e28ec93a97f5ef690d1cff91e3e9a9be25518524f9bcc01dd2"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c3a42dc760db44e4f66006da3412dbbb65a497ca64d3109d494149b655bf46fc"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a4bc788e65731e7f14cf9dd91d2369756bcc1865ea8e07d785b90f0000bad91b"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ce16a7e8b615cac7ded0c01acf516c9753533a7b1b320241992589cd3e1c192"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b5b7c310d9d8af5bca04a818e269b758c5b0b59076bd84c38fa0b48f21fb9ae"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d6d38b356d665c663ec08d98b232a2dfb6cbf55eee69839e9f3271b3314b2c52"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8647e6cc9db2a551d21b4198a12f111a8662d63bf3a72e3b55f56f335b0ebb9b"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/086ba82f1081ceac4892f784d0b35a2ea834a16cc19f03e6604ad3bf2306bc4d"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/78048701b8affcb1137290429ed99f3ca35e1125f38780ba2bada2ac783c8a4c"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8fa9556b21b7d462d32e63581366104f13618a3901cfa4a1a05e2b869940655b"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cfadf22e8f14d164ddd696c28359106418dcb90206f6d063c2be628a5441535c"}
{"level":"info","ts":"2026-07-27T19:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/af9800ce037fcaa1e233e538b4b43bbb698bd705a261a79aa04f4aff4fbfb498"}