{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"info","ts":"2026-07-09T17:06:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46500","PortSpecifier":{"PortValue":46500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46500","PortSpecifier":{"PortValue":46500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616800,"nanos":71472039},"http":{"id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd5b1c8c-8ef8-40a9-b999-fd8168360e7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46394","PortSpecifier":{"PortValue":46394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46394","PortSpecifier":{"PortValue":46394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616800,"nanos":114294203},"http":{"id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6317055a-36ef-43c6-9108-7f7f7257b9f5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46512","PortSpecifier":{"PortValue":46512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46512","PortSpecifier":{"PortValue":46512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616800,"nanos":154894030},"http":{"id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd\"}"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","subscription":"e2e-rate-iso-a-e1d938","tenant":"e2e-shared-a-d1f7bd","userId":"493f88e5-6164-4ca3-80cb-525916553fd0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e1d938\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e1d938"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","selected_subscription":"e2e-rate-iso-a-e1d938","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e1d938@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9eddac2-edc2-489f-8fc5-e9a78c5d81a7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46524","PortSpecifier":{"PortValue":46524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cd1857c4-47de-4456-9489-dd245490d0e1","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46524","PortSpecifier":{"PortValue":46524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616801,"nanos":218556237},"http":{"id":"cd1857c4-47de-4456-9489-dd245490d0e1","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd\"}"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","subscription":"e2e-rate-iso-a-e1d938","tenant":"e2e-shared-a-d1f7bd","userId":"493f88e5-6164-4ca3-80cb-525916553fd0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e1d938\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e1d938"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","selected_subscription":"e2e-rate-iso-a-e1d938","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e1d938@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd1857c4-47de-4456-9489-dd245490d0e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616802,"nanos":255625285},"http":{"id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UgP1MfxfU4MUcGNU_qJoppUnTrFNf8YliafehhEhBWA4MqoLCaajgZNHLBHd\"}"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","subscription":"e2e-rate-iso-a-e1d938","tenant":"e2e-shared-a-d1f7bd","userId":"493f88e5-6164-4ca3-80cb-525916553fd0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e1d938\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e1d938"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"493f88e5-6164-4ca3-80cb-525916553fd0","keyName":"e2e-rate-a-e1d938","selected_subscription":"e2e-rate-iso-a-e1d938","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e1d938@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e1d938","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78e6df76-2e6d-4c17-af7a-5c43036095f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49382","PortSpecifier":{"PortValue":49382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b675ed8-4f13-46ab-90c6-405847063fcc","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49382","PortSpecifier":{"PortValue":49382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616815,"nanos":169736095},"http":{"id":"0b675ed8-4f13-46ab-90c6-405847063fcc","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b675ed8-4f13-46ab-90c6-405847063fcc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45138","PortSpecifier":{"PortValue":45138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45138","PortSpecifier":{"PortValue":45138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616815,"nanos":208335370},"http":{"id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"658613f0-8c34-45ff-9d53-7c8f2b4cf3d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49386","PortSpecifier":{"PortValue":49386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49386","PortSpecifier":{"PortValue":49386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616815,"nanos":244341200},"http":{"id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs\"}"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","subscription":"e2e-rate-iso-a-e7b715","tenant":"e2e-shared-a-d1f7bd","userId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","selected_subscription":"e2e-rate-iso-a-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e7b715@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1ee64ab-9121-4dd6-97c2-807daf9a7aa8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49388","PortSpecifier":{"PortValue":49388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95985643-3412-44d6-958a-92b4af49f3c7","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49388","PortSpecifier":{"PortValue":49388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616816,"nanos":276801056},"http":{"id":"95985643-3412-44d6-958a-92b4af49f3c7","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs\"}"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","subscription":"e2e-rate-iso-a-e7b715","tenant":"e2e-shared-a-d1f7bd","userId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95985643-3412-44d6-958a-92b4af49f3c7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95985643-3412-44d6-958a-92b4af49f3c7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","selected_subscription":"e2e-rate-iso-a-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e7b715@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95985643-3412-44d6-958a-92b4af49f3c7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95985643-3412-44d6-958a-92b4af49f3c7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49400","PortSpecifier":{"PortValue":49400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b744e73-720c-47cb-ba74-38b06fb296a4","method":"POST","path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions","host":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49400","PortSpecifier":{"PortValue":49400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616817,"nanos":313229063},"http":{"id":"9b744e73-720c-47cb-ba74-38b06fb296a4","method":"POST","headers":{":authority":"e2e-shared-a-d1f7bd.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-TcmaPAyb2mOWfA9s_dfV48ChzsR89ZKCPr1kt1WwJ1V6tIepjNYt01ojnnLs\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","subscription":"e2e-rate-iso-a-e7b715","tenant":"e2e-shared-a-d1f7bd","userId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\",\"requestedSubscription\":\"e2e-rate-iso-a-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-d1f7bd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ad3aa2ca-0af0-4734-a451-21731cd1536e","keyName":"e2e-rate-a-e7b715","selected_subscription":"e2e-rate-iso-a-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-a-d1f7bd/e2e-rate-iso-a-e7b715@ai-tenant-e2e-shared-a-d1f7bd/rate-test-model-d1f7bd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d1f7bd","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e7b715","namespace":"ai-tenant-e2e-shared-a-d1f7bd","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b744e73-720c-47cb-ba74-38b06fb296a4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45144","PortSpecifier":{"PortValue":45144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"caff4d64-1234-4fd3-badf-fffd6e194a10","method":"POST","path":"/ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af/v1/completions","host":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:45144","PortSpecifier":{"PortValue":45144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616817,"nanos":342656472},"http":{"id":"caff4d64-1234-4fd3-badf-fffd6e194a10","method":"POST","headers":{":authority":"e2e-shared-b-e779af.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vsq4fkgop8S3yPqs_UEbtjDzFlt0lTJcqfHL8ArcVVHeKZ2RaEmoFgU2Jp1Y"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vsq4fkgop8S3yPqs_UEbtjDzFlt0lTJcqfHL8ArcVVHeKZ2RaEmoFgU2Jp1Y\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"46e9a5ce-58b4-4900-a6f1-ac9fea71d656","keyName":"e2e-rate-b-e7b715","subscription":"e2e-rate-iso-b-e7b715","tenant":"e2e-shared-b-e779af","userId":"46e9a5ce-58b4-4900-a6f1-ac9fea71d656","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\",\"requestedSubscription\":\"e2e-rate-iso-b-e7b715\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e779af.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e779af","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e7b715","namespace":"ai-tenant-e2e-shared-b-e779af","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e7b715"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"46e9a5ce-58b4-4900-a6f1-ac9fea71d656","keyName":"e2e-rate-b-e7b715","selected_subscription":"e2e-rate-iso-b-e7b715","selected_subscription_key":"ai-tenant-e2e-shared-b-e779af/e2e-rate-iso-b-e7b715@ai-tenant-e2e-shared-b-e779af/rate-test-model-e779af","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e779af","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e7b715","namespace":"ai-tenant-e2e-shared-b-e779af","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:06:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caff4d64-1234-4fd3-badf-fffd6e194a10","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24d0b079-baf4-436f-8690-d379c2d90218","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33128","PortSpecifier":{"PortValue":33128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24d0b079-baf4-436f-8690-d379c2d90218","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24d0b079-baf4-436f-8690-d379c2d90218","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33128","PortSpecifier":{"PortValue":33128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":717278998},"http":{"id":"24d0b079-baf4-436f-8690-d379c2d90218","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"24d0b079-baf4-436f-8690-d379c2d90218","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24d0b079-baf4-436f-8690-d379c2d90218","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24d0b079-baf4-436f-8690-d379c2d90218","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24d0b079-baf4-436f-8690-d379c2d90218","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24d0b079-baf4-436f-8690-d379c2d90218","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33138","PortSpecifier":{"PortValue":33138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29fe8b13-232d-4f58-96ff-72756fac502d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33138","PortSpecifier":{"PortValue":33138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":765265928},"http":{"id":"29fe8b13-232d-4f58-96ff-72756fac502d","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29fe8b13-232d-4f58-96ff-72756fac502d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33154","PortSpecifier":{"PortValue":33154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"975dec69-d2f4-4f2a-bfb8-238778e96591","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33154","PortSpecifier":{"PortValue":33154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":798197049},"http":{"id":"975dec69-d2f4-4f2a-bfb8-238778e96591","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"975dec69-d2f4-4f2a-bfb8-238778e96591","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33162","PortSpecifier":{"PortValue":33162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33162","PortSpecifier":{"PortValue":33162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":829293131},"http":{"id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","method":"POST","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca300bac-5b77-48c4-b3c3-6115d04e1e36","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33166","PortSpecifier":{"PortValue":33166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33166","PortSpecifier":{"PortValue":33166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":861984498},"http":{"id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d43ffdf2-5e9c-411c-83e1-157d0733fdb3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":887878536},"http":{"id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","keyName":"e2e-revoketest-a-0","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"3bea7674-ed69-4e22-b402-72d28cd64ec7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":887878536,"seconds":1783616824},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d19e044d-edd3-4478-9ac8-93ccd7d773f7","keyName":"e2e-revoketest-a-0","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bea7674-ed69-4e22-b402-72d28cd64ec7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33172","PortSpecifier":{"PortValue":33172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33172","PortSpecifier":{"PortValue":33172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":920488685},"http":{"id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"99f352b3-7161-4098-86d5-567c87e01d6c","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"99f352b3-7161-4098-86d5-567c87e01d6c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94605511-39ec-44c3-b9c7-1fc5ecfc4e29","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa7459a3-c053-4463-a2a5-80b707f22eff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":928115112},"http":{"id":"fa7459a3-c053-4463-a2a5-80b707f22eff","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"99f352b3-7161-4098-86d5-567c87e01d6c","keyName":"e2e-revoketest-a-1","subscription":"e2e-revoke-sub-a","tenant":"models-as-a-service","userId":"99f352b3-7161-4098-86d5-567c87e01d6c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-a","x-request-id":"fa7459a3-c053-4463-a2a5-80b707f22eff"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fa7459a3-c053-4463-a2a5-80b707f22eff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":928115112,"seconds":1783616824},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-a"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"99f352b3-7161-4098-86d5-567c87e01d6c","keyName":"e2e-revoketest-a-1","selected_subscription":"e2e-revoke-sub-a","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-a@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-a","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa7459a3-c053-4463-a2a5-80b707f22eff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33174","PortSpecifier":{"PortValue":33174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33174","PortSpecifier":{"PortValue":33174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":958964259},"http":{"id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c634c10d-f9f3-43d6-acc0-a57d89ce556e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":966131918},"http":{"id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"e282d98b-686a-4a84-ae81-f5eb784b59e3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":966131918,"seconds":1783616824},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e282d98b-686a-4a84-ae81-f5eb784b59e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33186","PortSpecifier":{"PortValue":33186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33186","PortSpecifier":{"PortValue":33186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616824,"nanos":998805147},"http":{"id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cb62fdd-2ef2-42c3-957a-46d184344b05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be61116c-bfd8-4f5c-9552-52d26465adff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616825,"nanos":10879754},"http":{"id":"be61116c-bfd8-4f5c-9552-52d26465adff","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"be61116c-bfd8-4f5c-9552-52d26465adff"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"be61116c-bfd8-4f5c-9552-52d26465adff","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":10879754,"seconds":1783616825},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be61116c-bfd8-4f5c-9552-52d26465adff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce4641211df61919a4b078b0d36e38c6c08ae297ecc8bef5d81a11bfb5b1b980"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9568f390bc5759c3e9e3d3a780c2578746bd83b3648cee8c82730eaf282f37aa"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e4cf736f0a357f4054e2399edd357b39466709b0f70c3a496276ed1f6823e7c"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18d6f89298d9a7b248e87ae9159fb3c3589ea9d804db18ec1f6e9ac06c2df42a"}
{"level":"info","ts":"2026-07-09T17:07:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/888f3c1bbd78553b0b23fd30fffc68b4608ab44e41fb8210034c6afccb4151d1"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a29065ed3b1fd24a479c993166edfe236e0414f67e5afc82e89e10a81038dd5"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33192","PortSpecifier":{"PortValue":33192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33192","PortSpecifier":{"PortValue":33192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":267420852},"http":{"id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-BG6qtX7CHF5W2AxC_iWoYcG88PCRnVi6JG2iuKY3Rbx2gsA0H323SLJ4AlnO\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e15cbd05-6e25-4ca2-bf39-31625a69ec79","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27231308-5992-9920-bf01-995ea60f8a08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33204","PortSpecifier":{"PortValue":33204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27231308-5992-9920-bf01-995ea60f8a08","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27231308-5992-9920-bf01-995ea60f8a08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33204","PortSpecifier":{"PortValue":33204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":292431184},"http":{"id":"27231308-5992-9920-bf01-995ea60f8a08","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sP3K75DHY0lE4PBE_QPOCHjDAZQzW7w9HWyxu8Yy8Lcls5nF3fV9YUvYqyua\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27231308-5992-9920-bf01-995ea60f8a08","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/53e7fab12b71c3ab5cf2bb9355c8b27f15c8d3d03b4885844fd84c987717ac9b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"27231308-5992-9920-bf01-995ea60f8a08","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27231308-5992-9920-bf01-995ea60f8a08","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27231308-5992-9920-bf01-995ea60f8a08","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"x-ext-auth-reason":""},{"content-type":"application/json"}],"body":"{\"error\": {\"type\": \"permission_error\", \"message\": \"API key is invalid or has been revoked\"}}"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":314732350},"http":{"id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96ef8ccc-9b6f-417e-8b75-f74eb74d6d19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":322090962},"http":{"id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1J33erYnZAV4O0RW8_GRJn8y7RujhEIaO4KuNQ14f2pRHVs64fKlH0LvmZSjJ","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":322090962,"seconds":1783616829},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5287138a-2f70-4bfa-9620-d5e7f42bdab6","keyName":"e2e-revoketest-b-0","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bc7c123-d298-4b80-a7a7-a79b2a8dc120","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":351893478},"http":{"id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","method":"GET","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"517ae8a0-d58a-4fb4-9c3c-e30c61333302","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07964373-a02c-4816-b212-096a830f9b6b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07964373-a02c-4816-b212-096a830f9b6b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07964373-a02c-4816-b212-096a830f9b6b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.40:50612","PortSpecifier":{"PortValue":50612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":359049165},"http":{"id":"07964373-a02c-4816-b212-096a830f9b6b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","subscription":"e2e-revoke-sub-b","tenant":"models-as-a-service","userId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"e2e-revoke-sub-b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07964373-a02c-4816-b212-096a830f9b6b","input":{"auth":{"identity":"Bearer **** simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-QYnnGjYjpfMtoy97_DkEGNd8z6H61L0Elw3zUZmYmA9HGOTWFoSFX2e2bztU","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.40","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctd2x6anQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.133.0.29~maas-default-gateway-openshift-default-56654dcf7-wlzjt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.40","x-forwarded-proto":"https","x-maas-subscription":"e2e-revoke-sub-b","x-request-id":"07964373-a02c-4816-b212-096a830f9b6b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"07964373-a02c-4816-b212-096a830f9b6b","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":359049165,"seconds":1783616829},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.40:50612","port":50612}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-revoke-sub-b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07964373-a02c-4816-b212-096a830f9b6b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0734337a-80e5-4da0-8ff4-369bf7dc32b7","keyName":"e2e-revoketest-b-1","selected_subscription":"e2e-revoke-sub-b","selected_subscription_key":"models-as-a-service/e2e-revoke-sub-b@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-revoke-sub-b","namespace":"models-as-a-service","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07964373-a02c-4816-b212-096a830f9b6b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07964373-a02c-4816-b212-096a830f9b6b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fddbfb6ec19c0b74d4540b1221f022def78e6ea9932b0c4e06fea1fd043f845c"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33230","PortSpecifier":{"PortValue":33230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","method":"DELETE","path":"/maas-api/v1/api-keys/5287138a-2f70-4bfa-9620-d5e7f42bdab6","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33230","PortSpecifier":{"PortValue":33230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":388847035},"http":{"id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","method":"DELETE","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5287138a-2f70-4bfa-9620-d5e7f42bdab6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/329f09105f1f3636b769f8bc7006e2f6473e54a0b1cc410788cf5d1f4ce2224b"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/5287138a-2f70-4bfa-9620-d5e7f42bdab6",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2bb6331-2a0d-42c6-87b5-361a3093cee1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9c2e00907ce1e1f508ada56690f9c54c604e2c881ca1c2da50010327976ebe8"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d0731aef4d21fee1a278a0aee03c59181bf61692770bf12bd4a26902b4e764a"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33232","PortSpecifier":{"PortValue":33232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","method":"DELETE","path":"/maas-api/v1/api-keys/0734337a-80e5-4da0-8ff4-369bf7dc32b7","host":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33232","PortSpecifier":{"PortValue":33232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783616829,"nanos":417498584},"http":{"id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","method":"DELETE","headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/0734337a-80e5-4da0-8ff4-369bf7dc32b7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d666edbb8ff4e0f7e04877c20aeccc21775181bd169caf093b5703bd0357f5e8"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"]}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/51232e6ec56b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=99ebbcaa-d41a-4ef2-9caa-25f6f44660d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"38105753-462f-4929-8d9d-e1c0d456c1f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.47508081-b354-42d3-b83d-51232e6ec56b.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/0734337a-80e5-4da0-8ff4-369bf7dc32b7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T17:07:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c85b864-14b3-42ef-a7f6-63ad4b148ca6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6352a28b5f6a5e3c034d50b3b848076433d3bf21a3e2dd03cdc961f5179828d3"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8c7a78f37e4052aa31e541052c737d24a89bb18770bfca867628e341b454542"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4606e838e466c2cc23205d73e678c8dac1419582b3dbf184b20337730db70307"}
{"level":"info","ts":"2026-07-09T17:07:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76eea057ec5e480ba29047c398f02bd0b11dfaac332908809df1429b290ee364"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50baf01b182584c22d80f3765570b4dbb1414372d96dc5513f2798a5e9ef6db5"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2d7656f48f2eb09fc8aa091ea581f55d5ac49aec1deca8566688b60d599cf5be"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ccb11658e0840e162c5c6f5a0f8d75f8cb0d84668d26cee14f0d26c13e69958"}
{"level":"info","ts":"2026-07-09T17:07:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/116f14f9fb7b54d6b0e93e1a025aa52e94a8b46e9e94228f95f326d8b874883c"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22ccfcf06733d95d1f0f48589abedadc3744d5a2ada57926a23f91cf59d966e5"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/234355e72298569e3929da94eafa8a3b1c535fe6d8d6531722863ec2d5580fae"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/59dd7dbb49727e1bc899c5b372d2e5d98bcd9866dfbea8405da172b50f3e2161"}
{"level":"info","ts":"2026-07-09T17:07:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f72df927f0d210e4bc518045bf146ebd4136ed2bdd5754e7670d878dfe42255d"}