--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"error","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db"}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db"}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:02:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:02:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54480","PortSpecifier":{"PortValue":54480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54480","PortSpecifier":{"PortValue":54480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616546,"nanos":730134385},"http":{"id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e5bb806-b2f8-48ff-b294-4963779eaa37","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53756","PortSpecifier":{"PortValue":53756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c4005722-6b24-45ec-a3fb-5753f81465fb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53756","PortSpecifier":{"PortValue":53756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616546,"nanos":789134955},"http":{"id":"c4005722-6b24-45ec-a3fb-5753f81465fb","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4005722-6b24-45ec-a3fb-5753f81465fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54486","PortSpecifier":{"PortValue":54486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","method":"GET","path":"/maas-api/v1/api-keys/04fd84fb-e13d-4479-bc9a-5479c8795e7b","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:54486","PortSpecifier":{"PortValue":54486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616546,"nanos":875206586},"http":{"id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","method":"GET","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/04fd84fb-e13d-4479-bc9a-5479c8795e7b",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/04fd84fb-e13d-4479-bc9a-5479c8795e7b",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fd675e0-ea0c-4f8d-a89d-be2ca63cdd5f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53764","PortSpecifier":{"PortValue":53764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"914f742b-4af8-43d3-ab30-4f7498afe628","method":"GET","path":"/maas-api/v1/api-keys/5b0e4a36-7c8f-4170-ad34-dff0f7c319c8","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53764","PortSpecifier":{"PortValue":53764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616546,"nanos":912852902},"http":{"id":"914f742b-4af8-43d3-ab30-4f7498afe628","method":"GET","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/5b0e4a36-7c8f-4170-ad34-dff0f7c319c8",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/5b0e4a36-7c8f-4170-ad34-dff0f7c319c8",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"914f742b-4af8-43d3-ab30-4f7498afe628","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59016","PortSpecifier":{"PortValue":59016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e26a84e4-ed70-4806-83c1-15062e544db6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59016","PortSpecifier":{"PortValue":59016}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616571,"nanos":378707928},"http":{"id":"e26a84e4-ed70-4806-83c1-15062e544db6","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e26a84e4-ed70-4806-83c1-15062e544db6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ded7975d-3b69-442e-bad6-e603989488a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46324","PortSpecifier":{"PortValue":46324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ded7975d-3b69-442e-bad6-e603989488a1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ded7975d-3b69-442e-bad6-e603989488a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46324","PortSpecifier":{"PortValue":46324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616571,"nanos":413597809},"http":{"id":"ded7975d-3b69-442e-bad6-e603989488a1","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ded7975d-3b69-442e-bad6-e603989488a1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ded7975d-3b69-442e-bad6-e603989488a1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ded7975d-3b69-442e-bad6-e603989488a1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ded7975d-3b69-442e-bad6-e603989488a1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ded7975d-3b69-442e-bad6-e603989488a1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ded7975d-3b69-442e-bad6-e603989488a1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ded7975d-3b69-442e-bad6-e603989488a1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ded7975d-3b69-442e-bad6-e603989488a1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ded7975d-3b69-442e-bad6-e603989488a1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ded7975d-3b69-442e-bad6-e603989488a1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ded7975d-3b69-442e-bad6-e603989488a1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59018","PortSpecifier":{"PortValue":59018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59018","PortSpecifier":{"PortValue":59018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616571,"nanos":450835978},"http":{"id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","method":"GET","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1M7aZYaEgBXYNKLdU_lZ91RQfZYadfbVsUtjJWY0PgU7hhfh8Uo9yMYRDQQvh"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1M7aZYaEgBXYNKLdU_lZ91RQfZYadfbVsUtjJWY0PgU7hhfh8Uo9yMYRDQQvh\"}"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5ffd166f-4b92-4b07-ba83-c3bff4984bca","keyName":"e2e-auth-iso-a-007f9c","subscription":"e2e-auth-iso-c84f16","tenant":"e2e-shared-a-d1f7bd","userId":"5ffd166f-4b92-4b07-ba83-c3bff4984bca","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-c84f16"}
{"level":"info","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:02:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cc3a5d9-5b98-4691-b29e-4bc84777532c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:41368","PortSpecifier":{"PortValue":41368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:41368","PortSpecifier":{"PortValue":41368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616588,"nanos":698104628},"http":{"id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b0bd03a-e82d-4fbc-bbd9-2bd2975d660a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35900","PortSpecifier":{"PortValue":35900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"48f0772f-b79b-4a5e-849a-156df168d8e3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35900","PortSpecifier":{"PortValue":35900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616588,"nanos":730788931},"http":{"id":"48f0772f-b79b-4a5e-849a-156df168d8e3","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48f0772f-b79b-4a5e-849a-156df168d8e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35906","PortSpecifier":{"PortValue":35906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:35906","PortSpecifier":{"PortValue":35906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616588,"nanos":768511774},"http":{"id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","method":"GET","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Fz7B27aa1sOQj7i0_Xv7XMaqojRf1z23nGxj4VXRCprlo69pJN440BDxVG0b"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Fz7B27aa1sOQj7i0_Xv7XMaqojRf1z23nGxj4VXRCprlo69pJN440BDxVG0b\"}"}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key not found","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","input":{"auth":{"identity":"Bearer **** not found","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T17:03:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14be9f4d-1388-4710-b590-c8ef4c7e68ea","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"application/json"},{"x-ext-auth-reason":""}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49504","PortSpecifier":{"PortValue":49504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49504","PortSpecifier":{"PortValue":49504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616605,"nanos":985441590},"http":{"id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24c2ba15-3d2e-41cc-b869-92bf5350d4c3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50106","PortSpecifier":{"PortValue":50106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50106","PortSpecifier":{"PortValue":50106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616606,"nanos":18551231},"http":{"id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"433b95e0-a4af-4b55-a06d-23c83c3c30a4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3914239d-215a-4081-89f6-25e908326b03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49506","PortSpecifier":{"PortValue":49506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3914239d-215a-4081-89f6-25e908326b03","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3914239d-215a-4081-89f6-25e908326b03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49506","PortSpecifier":{"PortValue":49506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616606,"nanos":55121846},"http":{"id":"3914239d-215a-4081-89f6-25e908326b03","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3914239d-215a-4081-89f6-25e908326b03","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3914239d-215a-4081-89f6-25e908326b03","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3914239d-215a-4081-89f6-25e908326b03","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3914239d-215a-4081-89f6-25e908326b03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3914239d-215a-4081-89f6-25e908326b03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3914239d-215a-4081-89f6-25e908326b03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3914239d-215a-4081-89f6-25e908326b03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3914239d-215a-4081-89f6-25e908326b03","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3914239d-215a-4081-89f6-25e908326b03","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3914239d-215a-4081-89f6-25e908326b03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3914239d-215a-4081-89f6-25e908326b03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50110","PortSpecifier":{"PortValue":50110}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50110","PortSpecifier":{"PortValue":50110}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616606,"nanos":86018656},"http":{"id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72152dbf-85a3-43cd-8a58-e7c6467e9c7d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52720","PortSpecifier":{"PortValue":52720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52720","PortSpecifier":{"PortValue":52720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616625,"nanos":330043756},"http":{"id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8b23ded-9c67-4c45-beab-d65fc3f61016","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45058","PortSpecifier":{"PortValue":45058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c50cc5c0-fc88-418a-bba2-58625f179f13","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45058","PortSpecifier":{"PortValue":45058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616625,"nanos":366973586},"http":{"id":"c50cc5c0-fc88-418a-bba2-58625f179f13","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c50cc5c0-fc88-418a-bba2-58625f179f13","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45074","PortSpecifier":{"PortValue":45074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","method":"GET","path":"/maas-api/v1/api-keys/97611415-b856-469c-958d-5a7a24c73670","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45074","PortSpecifier":{"PortValue":45074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616625,"nanos":400228637},"http":{"id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","method":"GET","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/97611415-b856-469c-958d-5a7a24c73670",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/97611415-b856-469c-958d-5a7a24c73670",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a9c8d79-8ec7-4db0-b4ac-e56d9b88edb1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52730","PortSpecifier":{"PortValue":52730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","method":"GET","path":"/maas-api/v1/api-keys/97611415-b856-469c-958d-5a7a24c73670","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:52730","PortSpecifier":{"PortValue":52730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616625,"nanos":436025687},"http":{"id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","method":"GET","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/97611415-b856-469c-958d-5a7a24c73670",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/97611415-b856-469c-958d-5a7a24c73670",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20d3d152-285a-4e1f-9e5d-d44a6e49f8df","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34794","PortSpecifier":{"PortValue":34794}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34794","PortSpecifier":{"PortValue":34794}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616644,"nanos":679265414},"http":{"id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93da7d4a-8e5c-4e52-8d05-2eaf6731bc51","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33976","PortSpecifier":{"PortValue":33976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33976","PortSpecifier":{"PortValue":33976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616644,"nanos":714401539},"http":{"id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/auth-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"374eeb6f-be9b-46cc-b838-6f10490c8d66","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"40420fce-871e-4389-927c-97eca69aa3d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34806","PortSpecifier":{"PortValue":34806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"40420fce-871e-4389-927c-97eca69aa3d3","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"40420fce-871e-4389-927c-97eca69aa3d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34806","PortSpecifier":{"PortValue":34806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616644,"nanos":747900350},"http":{"id":"40420fce-871e-4389-927c-97eca69aa3d3","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-9J0agcbaWj4BJlJy_6oyT4qLGvbJVCOq2Dy7IIYvA5cfyzTZBp6RlDd9pdvS"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-9J0agcbaWj4BJlJy_6oyT4qLGvbJVCOq2Dy7IIYvA5cfyzTZBp6RlDd9pdvS\"}"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"93409e77-0e67-401c-8fb8-0b721f4a42a9","keyName":"e2e-auth-iso-a-4f3d17","subscription":"e2e-auth-iso-50ed4f","tenant":"e2e-shared-a-d1f7bd","userId":"93409e77-0e67-401c-8fb8-0b721f4a42a9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"40420fce-871e-4389-927c-97eca69aa3d3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/auth-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"40420fce-871e-4389-927c-97eca69aa3d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-50ed4f"}
{"level":"info","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"40420fce-871e-4389-927c-97eca69aa3d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:04:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"40420fce-871e-4389-927c-97eca69aa3d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e"}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"debug","ts":"2026-07-09T17:04:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567"}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e06a56a3c36318e9139a70c1867f4cf0491f78fa184bb7e23e4e983a614f83de"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a23fbeaf7a7271f8fefc1ee142e6924f71f5535ffa6e3dfb79637c84e181c739"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/622ca63ec90f349275de7ff041169b9f3ea6bb2e1ed10eaea3c5b7b02004e56c"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d6fa67819f2d957fa55c8e53e95bf344d102301707f467cfab3968c73611000"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ead8b987d7dd6f50e947e30314ea0f9b3027c8893a5d46e686a7539ccadf1d85"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a1c0472551132ae9db2fe52cc81dc0dbb2691874083ae31f736f3c388adeb52"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4182060ed11a63603ac0bda4d54071923002c9056c0fc952c128fb0be42c7fec"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9687a82bbaa963a77f519403b22ef667d676a93c83d303b61c0dfdf682245ee6"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/189ab183eed3555d41911a62db51763cfcd57438041edcb3d07bf5833380c7a4"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a62dbc138da6e5ada95985392b708c51177bee49a657ca64ab51b9c2fee098db"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d6744dd08d8f78aadd9bec45a681f7f8e33f0def694f5c427b926bc625c47a9"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/82dbc3a4661aa9792081e4c2508281be227232cc1e2b39ef84a8db0ed082674d"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/14f295c0a69558f5b077aa3f9339ea148c19132c1b6b4da3cdd8cb9bc400a8f8"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab2eb19871896715942be720b2db9828407584764b89f05f451654a67b7e4e53"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3710bb65b1d2ebbd2f873de16f4ed6c8357effe9370898f89af0d8a54aa63b56"}
{"level":"info","ts":"2026-07-09T17:04:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/79e754c87c0cde46b59888c490d8470ad4f8f4149baddd8300e8484605bb6330"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"error","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"error","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"error","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"error","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:04:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b"}
{"level":"debug","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb"}
{"level":"info","ts":"2026-07-09T17:04:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"debug","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"debug","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"debug","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e"}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"debug","ts":"2026-07-09T17:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ccb11658e0840e162c5c6f5a0f8d75f8cb0d84668d26cee14f0d26c13e69958","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ccb11658e0840e162c5c6f5a0f8d75f8cb0d84668d26cee14f0d26c13e69958"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:05:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"error","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"50baf01b182584c22d80f3765570b4dbb1414372d96dc5513f2798a5e9ef6db5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"116f14f9fb7b54d6b0e93e1a025aa52e94a8b46e9e94228f95f326d8b874883c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/50baf01b182584c22d80f3765570b4dbb1414372d96dc5513f2798a5e9ef6db5"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/116f14f9fb7b54d6b0e93e1a025aa52e94a8b46e9e94228f95f326d8b874883c"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb"}
{"level":"debug","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"}
{"level":"info","ts":"2026-07-09T17:05:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8ace30d-1204-42f7-820e-b980c253620c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43272","PortSpecifier":{"PortValue":43272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c8ace30d-1204-42f7-820e-b980c253620c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8ace30d-1204-42f7-820e-b980c253620c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43272","PortSpecifier":{"PortValue":43272}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616705,"nanos":556029942},"http":{"id":"c8ace30d-1204-42f7-820e-b980c253620c","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c8ace30d-1204-42f7-820e-b980c253620c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c8ace30d-1204-42f7-820e-b980c253620c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c8ace30d-1204-42f7-820e-b980c253620c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8ace30d-1204-42f7-820e-b980c253620c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8ace30d-1204-42f7-820e-b980c253620c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8ace30d-1204-42f7-820e-b980c253620c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/sub-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c8ace30d-1204-42f7-820e-b980c253620c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8ace30d-1204-42f7-820e-b980c253620c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8ace30d-1204-42f7-820e-b980c253620c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8ace30d-1204-42f7-820e-b980c253620c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8ace30d-1204-42f7-820e-b980c253620c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37970","PortSpecifier":{"PortValue":37970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"70518c38-e274-4d7f-a86b-4a7f53254814","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37970","PortSpecifier":{"PortValue":37970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616705,"nanos":595644761},"http":{"id":"70518c38-e274-4d7f-a86b-4a7f53254814","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/sub-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70518c38-e274-4d7f-a86b-4a7f53254814","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43278","PortSpecifier":{"PortValue":43278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89d4ae65-3b28-4ba9-8715-182913374f89","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:43278","PortSpecifier":{"PortValue":43278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616705,"nanos":632594904},"http":{"id":"89d4ae65-3b28-4ba9-8715-182913374f89","method":"GET","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Uq3HMD4Q9R7pUDfp_2ygzMreLJhKhlMeir9qcUW3HysWgg4m5qqIYOjE27Rl"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Uq3HMD4Q9R7pUDfp_2ygzMreLJhKhlMeir9qcUW3HysWgg4m5qqIYOjE27Rl\"}"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"70313499-13cf-4d9c-9310-e188bf29ad1f","keyName":"e2e-sub-iso-f6eb8f","subscription":"e2e-a-only-a07893","tenant":"e2e-shared-a-d1f7bd","userId":"70313499-13cf-4d9c-9310-e188bf29ad1f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/sub-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-a07893"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89d4ae65-3b28-4ba9-8715-182913374f89","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96f851f2-9748-43b7-844e-d35625703e42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37974","PortSpecifier":{"PortValue":37974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96f851f2-9748-43b7-844e-d35625703e42","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96f851f2-9748-43b7-844e-d35625703e42","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37974","PortSpecifier":{"PortValue":37974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616705,"nanos":672034485},"http":{"id":"96f851f2-9748-43b7-844e-d35625703e42","method":"GET","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MyGbjfWRr8OM5Xz2_TETriZMSvZnAmp6WucbgbzF1L41DmgeANUsiXQ6dOMk"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MyGbjfWRr8OM5Xz2_TETriZMSvZnAmp6WucbgbzF1L41DmgeANUsiXQ6dOMk\"}"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9141e135-5362-46a6-8f36-80473c0617d5","keyName":"e2e-sub-iso-c3b686","subscription":"e2e-b-only-a07893","tenant":"e2e-shared-b-e779af","userId":"9141e135-5362-46a6-8f36-80473c0617d5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96f851f2-9748-43b7-844e-d35625703e42","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/sub-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-a07893"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96f851f2-9748-43b7-844e-d35625703e42","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96f851f2-9748-43b7-844e-d35625703e42","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96f851f2-9748-43b7-844e-d35625703e42","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37774","PortSpecifier":{"PortValue":37774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37774","PortSpecifier":{"PortValue":37774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616724,"nanos":303470288},"http":{"id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/sub-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4fba23f7-6ce4-493d-a715-771bd73f02d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89386dd0-851b-4131-b469-c82e06c08f62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38506","PortSpecifier":{"PortValue":38506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"89386dd0-851b-4131-b469-c82e06c08f62","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"89386dd0-851b-4131-b469-c82e06c08f62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38506","PortSpecifier":{"PortValue":38506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616724,"nanos":342761309},"http":{"id":"89386dd0-851b-4131-b469-c82e06c08f62","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"89386dd0-851b-4131-b469-c82e06c08f62","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"89386dd0-851b-4131-b469-c82e06c08f62","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"89386dd0-851b-4131-b469-c82e06c08f62","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89386dd0-851b-4131-b469-c82e06c08f62","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89386dd0-851b-4131-b469-c82e06c08f62","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"89386dd0-851b-4131-b469-c82e06c08f62","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/sub-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"89386dd0-851b-4131-b469-c82e06c08f62","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89386dd0-851b-4131-b469-c82e06c08f62","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"89386dd0-851b-4131-b469-c82e06c08f62","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89386dd0-851b-4131-b469-c82e06c08f62","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"89386dd0-851b-4131-b469-c82e06c08f62","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37790","PortSpecifier":{"PortValue":37790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1e7b422e-f69b-4778-b138-32400aa6c542","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37790","PortSpecifier":{"PortValue":37790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616724,"nanos":371441774},"http":{"id":"1e7b422e-f69b-4778-b138-32400aa6c542","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-u8r1W6kcB5xyeKzH_pLFp5weZvWqhrROq70kSACycB8kmH36t8va9qGi6aXT"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-u8r1W6kcB5xyeKzH_pLFp5weZvWqhrROq70kSACycB8kmH36t8va9qGi6aXT\"}"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5d863bf3-996f-455f-8815-a23e1d3ec0d2","keyName":"e2e-sub-iso-395498","subscription":"e2e-shared-sub-3d81d3","tenant":"e2e-shared-a-d1f7bd","userId":"5d863bf3-996f-455f-8815-a23e1d3ec0d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/sub-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-3d81d3"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e7b422e-f69b-4778-b138-32400aa6c542","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38514","PortSpecifier":{"PortValue":38514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6f8c740c-c95f-4919-861d-84a2c0588407","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:38514","PortSpecifier":{"PortValue":38514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616724,"nanos":398714913},"http":{"id":"6f8c740c-c95f-4919-861d-84a2c0588407","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ccuzKPodUUhSdx3T_Ina2uJnTEI6ZgLClgRP6balYcHjXiDXFIkssg12LtJC"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ccuzKPodUUhSdx3T_Ina2uJnTEI6ZgLClgRP6balYcHjXiDXFIkssg12LtJC\"}"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"db9c5675-4980-4ffa-8e8b-408263651231","keyName":"e2e-sub-iso-7e9fb1","subscription":"e2e-shared-sub-3d81d3","tenant":"e2e-shared-b-e779af","userId":"db9c5675-4980-4ffa-8e8b-408263651231","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/sub-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-3d81d3"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:05:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f8c740c-c95f-4919-861d-84a2c0588407","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3f8ab7cd4c8230a16b1e51beaee1fe40b1357afedd4306b39c6ca4ad1e58ca9c"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c5c5a3b367010e2528bf6e76a4cc78d2c1532bfc3868f2e90bb29ecba0f555da"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5439215712b5bea5e764499102ca92d59e6071308eabb65e1c129c4b82d3acdb"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a70e31a60d2dbf54808d7048adac699b232af60c8546f8274d8334c3b71a14f"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b4f90192b66707a5d6f15e9f59b9b368cd32bce129dd4830a9f9a98e10c6aea"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ebe3c54a3a028533edd93c9eea110f09b87b08ed2179b2fb0ad4434e56716aae"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2bbbe11f951f5454c59960c094ddbc686b96226f0935da07333fbc5217cf449f"}
{"level":"info","ts":"2026-07-09T17:05:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3fbd186126a170e8b0cc580871342a00adaf5d2966d8a89b6194b757fe8732f6"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0ec7aa344e626f879d23920f87bb2654e47009b5d2b3e7207d25fd7780f5567"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fd3a4010676f87e8d51fc063d2590054bd4b73dde4b0b29864dd10ca5c2162f"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86f2dc7155e33b026459d99cf616aa051ddfd43e6c6faeb424fcbbc6c4c46e6a"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4d3985f540d2963494bb51352542f7d93ba8dc5e23abfe2c2df04e516e351659"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e7c1eaf33283864345103aa618fb81e98489bbf1e304801871946ca1ca9cd0e"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4e1c29ab01e25a28fddd3123ff8e8f1bf88e5cce2559b5deaf0f702ace65d90b"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e741b3ff13f7b85813c90c8211f2e0be0a0ed4db718e6d6e4b472ed51bffe83a"}
{"level":"info","ts":"2026-07-09T17:05:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f280ffd9dd0a24fb5997201d31a6da9e3d41d9081aef3ebcc2e17bde97e22e46"}
{"level":"debug","ts":"2026-07-09T17:06:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"info","ts":"2026-07-09T17:06:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b"}
{"level":"debug","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"debug","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"debug","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"}
{"level":"error","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5"}
{"level":"error","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1"}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"}
{"level":"info","ts":"2026-07-09T17:06:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1"}
{"level":"debug","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8"}
{"level":"debug","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8"}
{"level":"debug","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ccb11658e0840e162c5c6f5a0f8d75f8cb0d84668d26cee14f0d26c13e69958","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ccb11658e0840e162c5c6f5a0f8d75f8cb0d84668d26cee14f0d26c13e69958"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"debug","ts":"2026-07-09T17:06:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:36Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"116f14f9fb7b54d6b0e93e1a025aa52e94a8b46e9e94228f95f326d8b874883c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/116f14f9fb7b54d6b0e93e1a025aa52e94a8b46e9e94228f95f326d8b874883c"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T17:06:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"50baf01b182584c22d80f3765570b4dbb1414372d96dc5513f2798a5e9ef6db5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/50baf01b182584c22d80f3765570b4dbb1414372d96dc5513f2798a5e9ef6db5"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46500","PortSpecifier":{"PortValue":46500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46500","PortSpecifier":{"PortValue":46500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616800,"nanos":71472039},"http":{"id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46394","PortSpecifier":{"PortValue":46394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46394","PortSpecifier":{"PortValue":46394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616800,"nanos":114294203},"http":{"id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46512","PortSpecifier":{"PortValue":46512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46512","PortSpecifier":{"PortValue":46512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616800,"nanos":154894030},"http":{"id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd\"}"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","subscription":"e2e-rate-iso-a-e1d938","tenant":"e2e-shared-a-d1f7bd","userId":"493f88e5-6164-4ca3-80cb-525916553fd0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e1d938\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e1d938"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","selected_subscription":"e2e-rate-iso-a-e1d938","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e1d938@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46524","PortSpecifier":{"PortValue":46524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cd1857c4-47de-4456-9489-dd245490d0e1","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46524","PortSpecifier":{"PortValue":46524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616801,"nanos":218556237},"http":{"id":"cd1857c4-47de-4456-9489-dd245490d0e1","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd\"}"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","subscription":"e2e-rate-iso-a-e1d938","tenant":"e2e-shared-a-d1f7bd","userId":"493f88e5-6164-4ca3-80cb-525916553fd0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e1d938\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e1d938"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","selected_subscription":"e2e-rate-iso-a-e1d938","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e1d938@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616802,"nanos":255625285},"http":{"id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd\"}"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","subscription":"e2e-rate-iso-a-e1d938","tenant":"e2e-shared-a-d1f7bd","userId":"493f88e5-6164-4ca3-80cb-525916553fd0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e1d938\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e1d938"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","selected_subscription":"e2e-rate-iso-a-e1d938","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e1d938@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49382","PortSpecifier":{"PortValue":49382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b675ed8-4f13-46ab-90c6-405847063fcc","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49382","PortSpecifier":{"PortValue":49382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616815,"nanos":169736095},"http":{"id":"0b675ed8-4f13-46ab-90c6-405847063fcc","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45138","PortSpecifier":{"PortValue":45138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45138","PortSpecifier":{"PortValue":45138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616815,"nanos":208335370},"http":{"id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49386","PortSpecifier":{"PortValue":49386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49386","PortSpecifier":{"PortValue":49386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616815,"nanos":244341200},"http":{"id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs\"}"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","subscription":"e2e-rate-iso-a-e7b715","tenant":"e2e-shared-a-d1f7bd","userId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","selected_subscription":"e2e-rate-iso-a-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e7b715@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49388","PortSpecifier":{"PortValue":49388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95985643-3412-44d6-958a-92b4af49f3c7","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49388","PortSpecifier":{"PortValue":49388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616816,"nanos":276801056},"http":{"id":"95985643-3412-44d6-958a-92b4af49f3c7","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs\"}"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","subscription":"e2e-rate-iso-a-e7b715","tenant":"e2e-shared-a-d1f7bd","userId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95985643-3412-44d6-958a-92b4af49f3c7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","selected_subscription":"e2e-rate-iso-a-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e7b715@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95985643-3412-44d6-958a-92b4af49f3c7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95985643-3412-44d6-958a-92b4af49f3c7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49400","PortSpecifier":{"PortValue":49400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b744e73-720c-47cb-ba74-38b06fb296a4","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49400","PortSpecifier":{"PortValue":49400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616817,"nanos":313229063},"http":{"id":"9b744e73-720c-47cb-ba74-38b06fb296a4","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","subscription":"e2e-rate-iso-a-e7b715","tenant":"e2e-shared-a-d1f7bd","userId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","selected_subscription":"e2e-rate-iso-a-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e7b715@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45144","PortSpecifier":{"PortValue":45144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"caff4d64-1234-4fd3-badf-fffd6e194a10","method":"POST","path":"/ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af/v1/completions","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45144","PortSpecifier":{"PortValue":45144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616817,"nanos":342656472},"http":{"id":"caff4d64-1234-4fd3-badf-fffd6e194a10","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vsq4fkgop8S3yPqs_UEbtjDzFlt0lTJcqfHL8ArcVVHeKZ2RaEmoFgU2Jp1Y"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vsq4fkgop8S3yPqs_UEbtjDzFlt0lTJcqfHL8ArcVVHeKZ2RaEmoFgU2Jp1Y\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"46e9a5ce-58b4-4900-a6f1-ac9fea71d656","keyName":"e2e-rate-b-e7b715","subscription":"e2e-rate-iso-b-e7b715","tenant":"e2e-shared-b-e779af","userId":"46e9a5ce-58b4-4900-a6f1-ac9fea71d656","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\",\"requestedSubscription\":\"e2e-rate-iso-b-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e779af","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e7b715","namespace":"ai-tenant-e2e-shared-b-e779af","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"46e9a5ce-58b4-4900-a6f1-ac9fea71d656","keyName":"e2e-rate-b-e7b715","selected_subscription":"e2e-rate-iso-b-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-b-e779af/e2e-rate-iso-b-e7b715@ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e779af","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e7b715","namespace":"ai-tenant-e2e-shared-b-e779af","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24d0b079-baf4-436f-8690-d379c2d90218","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33128","PortSpecifier":{"PortValue":33128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24d0b079-baf4-436f-8690-d379c2d90218","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24d0b079-baf4-436f-8690-d379c2d90218","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33128","PortSpecifier":{"PortValue":33128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":717278998},"http":{"id":"24d0b079-baf4-436f-8690-d379c2d90218","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"24d0b079-baf4-436f-8690-d379c2d90218","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24d0b079-baf4-436f-8690-d379c2d90218","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24d0b079-baf4-436f-8690-d379c2d90218","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24d0b079-baf4-436f-8690-d379c2d90218","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33138","PortSpecifier":{"PortValue":33138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29fe8b13-232d-4f58-96ff-72756fac502d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33138","PortSpecifier":{"PortValue":33138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":765265928},"http":{"id":"29fe8b13-232d-4f58-96ff-72756fac502d","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33154","PortSpecifier":{"PortValue":33154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"975dec69-d2f4-4f2a-bfb8-238778e96591","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33154","PortSpecifier":{"PortValue":33154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":798197049},"http":{"id":"975dec69-d2f4-4f2a-bfb8-238778e96591","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33162","PortSpecifier":{"PortValue":33162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33162","PortSpecifier":{"PortValue":33162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":829293131},"http":{"id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33166","PortSpecifier":{"PortValue":33166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33166","PortSpecifier":{"PortValue":33166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":861984498},"http":{"id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":887878536},"http":{"id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"3bea7674-ed69-4e22-b402-72d28cd64ec7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":887878536,"seconds":1783616824},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33172","PortSpecifier":{"PortValue":33172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33172","PortSpecifier":{"PortValue":33172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":920488685},"http":{"id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"99f352b3-7161-4098-86d5-567c87e01d6c","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"99f352b3-7161-4098-86d5-567c87e01d6c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa7459a3-c053-4463-a2a5-80b707f22eff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":928115112},"http":{"id":"fa7459a3-c053-4463-a2a5-80b707f22eff","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"99f352b3-7161-4098-86d5-567c87e01d6c","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"99f352b3-7161-4098-86d5-567c87e01d6c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"fa7459a3-c053-4463-a2a5-80b707f22eff"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fa7459a3-c053-4463-a2a5-80b707f22eff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":928115112,"seconds":1783616824},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"99f352b3-7161-4098-86d5-567c87e01d6c","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33174","PortSpecifier":{"PortValue":33174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33174","PortSpecifier":{"PortValue":33174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":958964259},"http":{"id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":966131918},"http":{"id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"e282d98b-686a-4a84-ae81-f5eb784b59e3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":966131918,"seconds":1783616824},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33186","PortSpecifier":{"PortValue":33186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33186","PortSpecifier":{"PortValue":33186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":998805147},"http":{"id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be61116c-bfd8-4f5c-9552-52d26465adff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616825,"nanos":10879754},"http":{"id":"be61116c-bfd8-4f5c-9552-52d26465adff","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"be61116c-bfd8-4f5c-9552-52d26465adff"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"be61116c-bfd8-4f5c-9552-52d26465adff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":10879754,"seconds":1783616825},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33192","PortSpecifier":{"PortValue":33192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33192","PortSpecifier":{"PortValue":33192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":267420852},"http":{"id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27231308-5992-9920-bf01-995ea60f8a08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33204","PortSpecifier":{"PortValue":33204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27231308-5992-9920-bf01-995ea60f8a08","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27231308-5992-9920-bf01-995ea60f8a08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33204","PortSpecifier":{"PortValue":33204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":292431184},"http":{"id":"27231308-5992-9920-bf01-995ea60f8a08","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27231308-5992-9920-bf01-995ea60f8a08","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27231308-5992-9920-bf01-995ea60f8a08","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27231308-5992-9920-bf01-995ea60f8a08","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":314732350},"http":{"id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":322090962},"http":{"id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":322090962,"seconds":1783616829},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":351893478},"http":{"id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07964373-a02c-4816-b212-096a830f9b6b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07964373-a02c-4816-b212-096a830f9b6b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07964373-a02c-4816-b212-096a830f9b6b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":359049165},"http":{"id":"07964373-a02c-4816-b212-096a830f9b6b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07964373-a02c-4816-b212-096a830f9b6b","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"07964373-a02c-4816-b212-096a830f9b6b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"07964373-a02c-4816-b212-096a830f9b6b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":359049165,"seconds":1783616829},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07964373-a02c-4816-b212-096a830f9b6b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07964373-a02c-4816-b212-096a830f9b6b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33230","PortSpecifier":{"PortValue":33230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","method":"DELETE","path":"/maas-api/v1/api-keys/5287138a-2f70-4bfa-9620-d5e7f42bdab6","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33230","PortSpecifier":{"PortValue":33230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":388847035},"http":{"id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","method":"DELETE","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5287138a-2f70-4bfa-9620-d5e7f42bdab6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5287138a-2f70-4bfa-9620-d5e7f42bdab6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33232","PortSpecifier":{"PortValue":33232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","method":"DELETE","path":"/maas-api/v1/api-keys/0734337a-80e5-4da0-8ff4-369bf7dc32b7","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33232","PortSpecifier":{"PortValue":33232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":417498584},"http":{"id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","method":"DELETE","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/0734337a-80e5-4da0-8ff4-369bf7dc32b7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/0734337a-80e5-4da0-8ff4-369bf7dc32b7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50baf01b182584c22d80f3765570b4dbb1414372d96dc5513f2798a5e9ef6db5"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ccb11658e0840e162c5c6f5a0f8d75f8cb0d84668d26cee14f0d26c13e69958"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/116f14f9fb7b54d6b0e93e1a025aa52e94a8b46e9e94228f95f326d8b874883c"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}