{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0076c9e5-e8a8-468a-ab9a-b3149586b84e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:36754","PortSpecifier":{"PortValue":36754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:36754","PortSpecifier":{"PortValue":36754}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188389,"nanos":661018862},"http":{"id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d9c8f46-ecd1-4a9e-8189-be51e5a195ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48424","PortSpecifier":{"PortValue":48424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48424","PortSpecifier":{"PortValue":48424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188390,"nanos":702952375},"http":{"id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a38b9f09-8b41-4941-8080-fab6f5dc057a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91453406-b454-427e-b096-e243fe212aad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48440","PortSpecifier":{"PortValue":48440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91453406-b454-427e-b096-e243fe212aad","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91453406-b454-427e-b096-e243fe212aad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48440","PortSpecifier":{"PortValue":48440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188391,"nanos":742108948},"http":{"id":"91453406-b454-427e-b096-e243fe212aad","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91453406-b454-427e-b096-e243fe212aad","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91453406-b454-427e-b096-e243fe212aad","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91453406-b454-427e-b096-e243fe212aad","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91453406-b454-427e-b096-e243fe212aad","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91453406-b454-427e-b096-e243fe212aad","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91453406-b454-427e-b096-e243fe212aad","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"667b2928-993b-4636-bb32-3d70e948732b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48448","PortSpecifier":{"PortValue":48448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"667b2928-993b-4636-bb32-3d70e948732b","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"667b2928-993b-4636-bb32-3d70e948732b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48448","PortSpecifier":{"PortValue":48448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188392,"nanos":789323405},"http":{"id":"667b2928-993b-4636-bb32-3d70e948732b","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"667b2928-993b-4636-bb32-3d70e948732b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"667b2928-993b-4636-bb32-3d70e948732b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"667b2928-993b-4636-bb32-3d70e948732b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"667b2928-993b-4636-bb32-3d70e948732b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48456","PortSpecifier":{"PortValue":48456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48456","PortSpecifier":{"PortValue":48456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188393,"nanos":827017806},"http":{"id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"039ee4e1-0f6d-4495-80a0-f92ebbf489ea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48468","PortSpecifier":{"PortValue":48468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48468","PortSpecifier":{"PortValue":48468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188394,"nanos":864891803},"http":{"id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca18df8d-8846-4eeb-9e98-b5d9f706f241","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48476","PortSpecifier":{"PortValue":48476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48476","PortSpecifier":{"PortValue":48476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188395,"nanos":903957680},"http":{"id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a7b9d3f-e03e-4d5b-b901-69ec0f5020c7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48480","PortSpecifier":{"PortValue":48480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","method":"POST","path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions","host":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:48480","PortSpecifier":{"PortValue":48480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188396,"nanos":941503818},"http":{"id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","method":"POST","headers":{":authority":"e2e-shared-a-6dd721.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-z800tHFKeIb5Vtr8_ZMRkAzhq4Ctr0edDY0KW1PPTH4miZKDCU4UupsT2syT\"}"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","subscription":"e2e-rate-iso-a-002aa8","tenant":"e2e-shared-a-6dd721","userId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\",\"requestedSubscription\":\"e2e-rate-iso-a-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-6dd721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5831cfbd-f1f0-4ed1-84a9-bf4f661da0ec","keyName":"e2e-rate-a-002aa8","selected_subscription":"e2e-rate-iso-a-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-a-6dd721/e2e-rate-iso-a-002aa8@ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-6dd721/models/facebook/opt-125m","name":"rate-test-model-6dd721","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-002aa8","namespace":"ai-tenant-e2e-shared-a-6dd721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-6dd721/rate-test-model-6dd721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d0b7a33-1774-4e25-b598-7e9cc8e45dca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"678e07e5-735f-4731-810a-7904640ff880","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:60718","PortSpecifier":{"PortValue":60718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"678e07e5-735f-4731-810a-7904640ff880","method":"POST","path":"/ai-tenant-e2e-shared-b-5f50cb/rate-test-model-5f50cb/v1/completions","host":"e2e-shared-b-5f50cb.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"678e07e5-735f-4731-810a-7904640ff880","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:60718","PortSpecifier":{"PortValue":60718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188396,"nanos":979996950},"http":{"id":"678e07e5-735f-4731-810a-7904640ff880","method":"POST","headers":{":authority":"e2e-shared-b-5f50cb.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-5f50cb/rate-test-model-5f50cb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Afyjt0m8S1MkHjGo_4ewr7QZ8Tl7Dfldrj0pjmQHHZeMHxaXT4GjXoOZxDjY"}
{"level":"debug","ts":"2026-07-27T21:39:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"678e07e5-735f-4731-810a-7904640ff880","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5f50cb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Afyjt0m8S1MkHjGo_4ewr7QZ8Tl7Dfldrj0pjmQHHZeMHxaXT4GjXoOZxDjY\"}"}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5f50cb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6be734e8-34f9-4e60-862d-aefc9e38a799","keyName":"e2e-rate-b-002aa8","subscription":"e2e-rate-iso-b-002aa8","tenant":"e2e-shared-b-5f50cb","userId":"6be734e8-34f9-4e60-862d-aefc9e38a799","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"678e07e5-735f-4731-810a-7904640ff880","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-5f50cb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-5f50cb/rate-test-model-5f50cb\",\"requestedSubscription\":\"e2e-rate-iso-b-002aa8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5f50cb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-5f50cb/models/facebook/opt-125m","name":"rate-test-model-5f50cb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-002aa8","namespace":"ai-tenant-e2e-shared-b-5f50cb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-5f50cb/rate-test-model-5f50cb"}}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"678e07e5-735f-4731-810a-7904640ff880","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5f50cb/rate-test-model-5f50cb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5f50cb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-002aa8"}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"678e07e5-735f-4731-810a-7904640ff880","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6be734e8-34f9-4e60-862d-aefc9e38a799","keyName":"e2e-rate-b-002aa8","selected_subscription":"e2e-rate-iso-b-002aa8","selected_subscription_key":"ai-tenant-e2e-shared-b-5f50cb/e2e-rate-iso-b-002aa8@ai-tenant-e2e-shared-b-5f50cb/rate-test-model-5f50cb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-5f50cb/models/facebook/opt-125m","name":"rate-test-model-5f50cb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-002aa8","namespace":"ai-tenant-e2e-shared-b-5f50cb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-5f50cb/rate-test-model-5f50cb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"678e07e5-735f-4731-810a-7904640ff880","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:39:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"678e07e5-735f-4731-810a-7904640ff880","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:40:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52a8c1a09b49c02a1e3499dc1d791afee466a7708d28edd95ad1953cecaef5a1"}
{"level":"info","ts":"2026-07-27T21:40:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e47dfae870c1fed8d18f284402be6735f35b9c15104e56f64da763e1ecd66aa7"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/676dc4ff7593b4a9797d05376d190cf02d21f77807d8871d2f835813b0405377"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5a9f603fed75b087b7ab3cce8d559450dba982932512bba588df37bd1475dee7"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b2f8a8d8a104a4d07551effe53b4f45507799b52e6800b05a155e4e7123208a"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01b0110395146dcdec24c90d1201343ca78d73b98d89de9850d81431d7d723bd"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60a2e141e956336874f72e5f7de6d5673295093ce3ca711bd93b293e50c81ab9"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/226a63be2daac7727fe404c38eeb351b2157652e7af8271d3e8768401f1f8296"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4197a2b93f8dbd7aa82017ae5a8541a42bbaad0fda379ebf472db5d2c6e7d6a6"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e2992924c4a24a92cbb7fd1a61edea2c05163b945121a5b05adb51c8ad034bc"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55fe3ff263ee6f06310557c82506aacd8d4facb0b7a9a8461fc35dbb334e19f9"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c5f1730c4a2f6632e013470f40abe28e587eb5fb3751315922b824aa11cb94e"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/84729b86618c87ebf4674ac18a0a9fd9a274c92573ca1dec0fab9d2a2e31cbda"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0afe26ec61993ea9495d1a9896095a05c1f715fada816f5385478278a498dc72"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dcd76b8fffac1755e12d534a23bce9579db73ae50cd7b0da466e95a7d2c9e07b"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a44fa93540b5b06c4a60700e07dcb8ff3414ba57d19ba75e7d2e97537da1564"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/987cc1f4c30a751f9d3af041f4379b2ed08f9fa3e44b2243ced9ae05c35db2ef"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f2959d44a3ddab9a0160a47d28d7b6b9c0b196fbf2571fbbaada799bdc12ad15"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d92e99dd604416c6815eb5b299965e031d87d66d3c5334e6614ef109c8a18bb"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44b49f4234c5cc0c60b3cf7f371b94e33335b0033cb8cea111604c21d1e8f61c"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7f419472cb15c8bbb058f7bd1747e0ea394b50b269ef717c33c2a2d0a6302e6b"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/de08d404e6ba20da0056b4ca7523e3da2c4bb0653a8d53bf77c53e3deac5bd47"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fac9d16400ee46c2d09832ef95f12d524a8831f34fe9101be5bf8d465ff2840"}
{"level":"info","ts":"2026-07-27T21:40:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e38f14f4bb095813e437d1be84d5e91cab9ced1c3d2c6a940e0300dafdf6649f"}
{"level":"info","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"38c17600-3eed-4577-99c0-abb3df4108be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:34948","PortSpecifier":{"PortValue":34948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"38c17600-3eed-4577-99c0-abb3df4108be","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"38c17600-3eed-4577-99c0-abb3df4108be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:34948","PortSpecifier":{"PortValue":34948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188461,"nanos":307929599},"http":{"id":"38c17600-3eed-4577-99c0-abb3df4108be","method":"POST","headers":{":authority":"maas.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"38c17600-3eed-4577-99c0-abb3df4108be","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"38c17600-3eed-4577-99c0-abb3df4108be","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2e7d9977-5dee-4bb3-ada6-daaad217e479","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b1a5ea90-f424-41db-9c64-608cae894f90"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/61d98c4f95d2"]}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"38c17600-3eed-4577-99c0-abb3df4108be","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/61d98c4f95d2"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b1a5ea90-f424-41db-9c64-608cae894f90"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2e7d9977-5dee-4bb3-ada6-daaad217e479","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38c17600-3eed-4577-99c0-abb3df4108be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38c17600-3eed-4577-99c0-abb3df4108be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38c17600-3eed-4577-99c0-abb3df4108be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"38c17600-3eed-4577-99c0-abb3df4108be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38c17600-3eed-4577-99c0-abb3df4108be","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38c17600-3eed-4577-99c0-abb3df4108be","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38c17600-3eed-4577-99c0-abb3df4108be","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38c17600-3eed-4577-99c0-abb3df4108be","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:34956","PortSpecifier":{"PortValue":34956}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:34956","PortSpecifier":{"PortValue":34956}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188461,"nanos":363506130},"http":{"id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","method":"POST","headers":{":authority":"maas.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1KRNouZpqipl1zVqo_NwivMJ1jUpG3RNCjUTVaEiaRN2WC59kp4YiKgJUIB17"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1KRNouZpqipl1zVqo_NwivMJ1jUpG3RNCjUTVaEiaRN2WC59kp4YiKgJUIB17\"}"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bb1f4c16-7440-4d6d-af51-770471266421","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"bb1f4c16-7440-4d6d-af51-770471266421","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bb1f4c16-7440-4d6d-af51-770471266421","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:41:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaa0f184-5d9f-493a-9a5a-89f97e66d9c6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"error","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5"}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062"}
{"level":"error","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e"}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"error","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T21:41:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T21:41:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:43184","PortSpecifier":{"PortValue":43184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-b4bf5c.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:43184","PortSpecifier":{"PortValue":43184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188511,"nanos":805676591},"http":{"id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","method":"POST","headers":{":authority":"e2e-ipp-a-b4bf5c.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2e7d9977-5dee-4bb3-ada6-daaad217e479","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b1a5ea90-f424-41db-9c64-608cae894f90"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/61d98c4f95d2"]}}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/61d98c4f95d2"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b1a5ea90-f424-41db-9c64-608cae894f90"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2e7d9977-5dee-4bb3-ada6-daaad217e479","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-b4bf5c.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-b4bf5c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:41:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e863cfc-9ec7-49ce-8764-e60d869a0b9e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:43194","PortSpecifier":{"PortValue":43194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"825045d9-3f39-404a-9a32-9c77631ca8ef","method":"POST","path":"/ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c/v1/chat/completions","host":"e2e-ipp-a-b4bf5c.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:43194","PortSpecifier":{"PortValue":43194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785188513,"nanos":874969176},"http":{"id":"825045d9-3f39-404a-9a32-9c77631ca8ef","method":"POST","headers":{":authority":"e2e-ipp-a-b4bf5c.apps.e26c9676-12cc-4cb6-ab13-61d98c4f95d2.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-EFCQ7TKAOyD85hWZ_ojjMY7gWPZIVOfHYFS9YMbVL7haFCb5BGpSUVM1SFre"}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-b4bf5c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-EFCQ7TKAOyD85hWZ_ojjMY7gWPZIVOfHYFS9YMbVL7haFCb5BGpSUVM1SFre\"}"}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-b4bf5c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6887b8d3-b893-45be-aa7e-c96b1b5406c7","keyName":"e2e-ipp-b4bf5c","subscription":"ipp-route-b4bf5c-sub","tenant":"e2e-ipp-a-b4bf5c","userId":"6887b8d3-b893-45be-aa7e-c96b1b5406c7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-b4bf5c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c\",\"requestedSubscription\":\"ipp-route-b4bf5c-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-b4bf5c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-b4bf5c/models/facebook/opt-125m","name":"ipp-route-b4bf5c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-b4bf5c-sub","namespace":"ai-tenant-e2e-ipp-a-b4bf5c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c"}}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-b4bf5c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-b4bf5c-sub"}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6887b8d3-b893-45be-aa7e-c96b1b5406c7","keyName":"e2e-ipp-b4bf5c","selected_subscription":"ipp-route-b4bf5c-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c-sub@ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-b4bf5c/models/facebook/opt-125m","name":"ipp-route-b4bf5c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-b4bf5c-sub","namespace":"ai-tenant-e2e-ipp-a-b4bf5c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-b4bf5c/ipp-route-b4bf5c"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T21:41:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"825045d9-3f39-404a-9a32-9c77631ca8ef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T21:42:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1b4bffd0406c0b5f94ea6599c3c8727c15887b411d83c5f60304cad2c17b70fb"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7dba1ca910afa4d98f33f88845bc2d86afbffc42e8d801a332097f2b39c9a259"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f6019104f1ae457f86b2ab241e04df149b1b5886108a75bd03f10496d13980f"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8f8582905d55eb5ae0dde5242f2dfab9415c1023e816de657d826d9e0249b062"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d065fe30787d26d994daaf564e1a883e18d10872e1c7682f7203e693de3f215f"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d51d549961a280cc43eb2d4521b2cb60684e9a9dd17abccf5e879dba4f23255e"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c1622f5824f797b5a32f4a9d6d82f333235b47c9c2860622b3981901010bebb"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/667c5360802e6a970022aa7646329bb1b079a975d1604bee668fa794d10e25f5"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a6142370221b4443e16276d1cb04289cc319190568b22f5dc5e586a401a6c725"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/34d3e3f0dfa50db6a33bbb7f5abd131280270b7809c3180b8f593bc87732c85c"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/048c811307c8a325a250a323c9364ec3e3656bcf9758bb913403c0b39fc75b9e"}
{"level":"info","ts":"2026-07-27T21:42:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/609d645fca3458faca501950cc6e38ee4de1c42624837488c3270127b68b887f"}