{"level":"info","ts":"2026-07-21T16:19:01.213Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:01.213Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:01.302Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-524b80","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:01.381Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-07-21T16:19:01.782Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:01.783Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:01.783Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:01.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:01.787Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:19:01.787Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:01.787Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:02.210Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:02.211Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:02.280Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-524b80","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:04.133Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","TokenRateLimitPolicy"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-21T16:19:04.586Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:04.588Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:04.589Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:19:04.590Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:04.590Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:04.680Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:04.684Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:05.021Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:05.021Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:05.033Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-524b80","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:05.282Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-07-21T16:19:05.588Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:05.591Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:05.680Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:05.680Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:05.680Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:05.681Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-524b80","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-a-524b80","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-524b80","uid":"42046b73-4be1-4256-9755-594aad3a210b"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-524b80"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-524b80\" already exists"}
{"level":"info","ts":"2026-07-21T16:19:05.781Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-21T16:19:05.884Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:05.884Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:06.106Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-524b80","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-a-524b80","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-524b80","uid":"42046b73-4be1-4256-9755-594aad3a210b"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"allow_on_headers_stop_iteration":true,"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"7c15181436d05615b42f0f5fe6c9e20c60b26a9e2275e5cb71cb925f66a6d363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"9cecb280fb2c50d87027886279beb8df39d9be1bbc84159c99535ff2f660f9a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"10e44e0a4d893201b7c9fc4d74d716e72662331ccc2351e69479390a85d099e7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"ae903e97aea52c26598a31361c6d35f37569dfe58305f0120e1e3279a42637dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"200ms\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"7ac45a6326d824a9ba78552d829e7cd1477ad2385a3ca741d78deb687df54777"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-524b80"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-524b80\" already exists"}
{"level":"error","ts":"2026-07-21T16:19:06.309Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-524b80","namespace":"openshift-ingress","uid":"c4a46aa7-be23-49ea-b347-a587feb7d3bc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:19:06.391Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"350b65ef-0720-4e23-a129-e3f994e54e59","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:19:06.403Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"69ae2916-cb87-4714-83f9-28048866cde6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:06.403Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:06.403Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:06.413Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-a-524b80","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:07.887Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","EnvoyFilter","HTTPRoute","Gateway","Limitador","ConfigMap"],"eventTypes":{"create":3,"update":7}}
{"level":"info","ts":"2026-07-21T16:19:07.906Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:08.191Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:19:08.583Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:19:08.583Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:08.783Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:08.784Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:08.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:19:08.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:08.788Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:08.788Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:08.789Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:09.334Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:09.334Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:09.347Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-bbeb7d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:12.693Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-21T16:19:12.780Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:13.083Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:19:13.280Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:19:13.280Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:13.381Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:13.382Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:13.382Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:13.385Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:13.387Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:19:13.387Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:13.396Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:13.928Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:13.928Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:14.091Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-07-21T16:19:14.882Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:14.883Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:14.884Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:19:14.886Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:14.886Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:14.886Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:14.890Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:14.890Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:14.892Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-bbeb7d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/ratelimit":"true"},"name":"kuadrant-ratelimiting-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-bbeb7d","uid":"8cc2df7b-ce2e-4026-9b68-135049ef09d3"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"limitador-limitador.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-ratelimit-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"limitador-limitador.kuadrant-system.svc.cluster.local","port_value":8081}}}}]}]},"name":"kuadrant-ratelimit-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-bbeb7d"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-b-bbeb7d\" already exists"}
{"level":"error","ts":"2026-07-21T16:19:15.214Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-bbeb7d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"name":"kuadrant-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-bbeb7d","uid":"8cc2df7b-ce2e-4026-9b68-135049ef09d3"}]},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"allow_on_headers_stop_iteration":true,"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"4f5ef06554de86565f1d2bcf61b7561a3bc5d71e4d3d88664d3d633dcb75ab89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"d2c7e6d6ac5e661ee28578ea377d51eb89ce5051d7c07327d777cfa0fcaa3f7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"82f7c162ce6b5af7424272af838c0ea4c34a431afe53d78c6a1645ecc5eb5d8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"2f443594dddcd77149bcfe9534ecaee49a03ff9bbedca351abb5f582041bd9b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"200ms\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"7ac45a6326d824a9ba78552d829e7cd1477ad2385a3ca741d78deb687df54777"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-bbeb7d"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-bbeb7d\" already exists"}
{"level":"error","ts":"2026-07-21T16:19:15.410Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"69ae2916-cb87-4714-83f9-28048866cde6","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:19:15.488Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-524b80","namespace":"openshift-ingress","uid":"c4a46aa7-be23-49ea-b347-a587feb7d3bc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:19:15.510Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"350b65ef-0720-4e23-a129-e3f994e54e59","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:19:15.515Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","uid":"a1837cc6-d4e7-4f43-bef3-a68605133776","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:15.516Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:15.516Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-21T16:19:15.523Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-bbeb7d","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:19:15.592Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-bbeb7d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:19:18.494Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","EnvoyFilter","TokenRateLimitPolicy","HTTPRoute","Limitador"],"eventTypes":{"create":2,"update":8}}
{"level":"info","ts":"2026-07-21T16:19:18.580Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:18.683Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:19:18.880Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:19:18.881Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:19.306Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:19.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:19.383Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:19.383Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:19.383Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:19:19.383Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:19.385Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:20.038Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:20.038Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:21.488Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-21T16:19:21.583Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:21.798Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:19:21.980Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:19:21.980Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:22.294Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:22.295Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:19:22.295Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:22.380Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:22.381Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:22.381Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:22.887Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:22.887Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:35.088Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","ConfigMap"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-21T16:19:35.689Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:35.690Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:19:35.690Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:35.690Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:35.689Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:35.784Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:35.785Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:36.320Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:36.320Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:38.395Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","EnvoyFilter","ConfigMap","HTTPRoute"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-21T16:19:38.492Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:38.498Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:19:38.586Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:19:38.587Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:38.987Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:38.988Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:38.988Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:39.080Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:39.080Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:39.081Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:19:39.081Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:39.428Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:39.428Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:40.591Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-21T16:19:40.604Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:40.785Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:19:40.886Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:19:40.886Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:41.189Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:41.189Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:41.189Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:41.190Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:19:41.190Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:19:41.190Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:19:41.605Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:19:41.605Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:13.690Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-21T16:20:14.482Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:14.484Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:14.484Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:14.485Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:14.487Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:14.487Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:14.499Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:15.189Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:15.189Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:17.088Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","TokenRateLimitPolicy","EnvoyFilter","Limitador","ConfigMap"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-21T16:20:17.182Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:17.188Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:20:17.380Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:20:17.380Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:17.692Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:17.780Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:17.782Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:20:17.782Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:17.784Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:17.784Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:17.785Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:18.251Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:18.280Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:19.493Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-21T16:20:19.506Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:19.682Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:20:20.180Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:20:20.180Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:20.282Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:20.282Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:20.282Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:20.284Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:20:20.284Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:20.284Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:20.910Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:20.910Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:29.888Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":1}}
{"level":"info","ts":"2026-07-21T16:20:30.494Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:30.496Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:30.584Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:30.681Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:30.681Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:30.682Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:35.092Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthPolicy","EnvoyFilter","HTTPRoute","Gateway","AuthConfig","ConfigMap"],"eventTypes":{"create":13,"update":12}}
{"level":"info","ts":"2026-07-21T16:20:35.197Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:35.206Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:20:35.282Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:20:35.282Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:35.785Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:35.786Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:35.786Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:35.788Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:35.790Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:35.985Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-21T16:20:36.089Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:20:36.089Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:37.296Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:37.296Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:37.683Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":2}}
{"level":"info","ts":"2026-07-21T16:20:38.482Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:38.482Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:38.484Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:38.485Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:38.485Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-21T16:20:38.489Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:20:38.489Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-21T16:20:38.495Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to create envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-bbeb7d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"kuadrant-auth-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-bbeb7d","uid":"8cc2df7b-ce2e-4026-9b68-135049ef09d3"}]},"spec":{"configPatches":[{"applyTo":"CLUSTER","match":{"cluster":{"service":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-auth-service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"authorino-authorino-authorization.kuadrant-system.svc.cluster.local","port_value":50051}}}}]}]},"name":"kuadrant-auth-service","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-bbeb7d"}]},"status":{}},"error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-b-bbeb7d\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.496Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"3a6da92f67b982ed932b2125a997bdb04f74c130ede9dc66d0a5672d22431026","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["3a6da92f67b982ed932b2125a997bdb04f74c130ede9dc66d0a5672d22431026"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"3a6da92f67b982ed932b2125a997bdb04f74c130ede9dc66d0a5672d22431026\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.595Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-8","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-8"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b28c4187fedd4da4f87f1f5cc104bb0ce438f1ace484164398e07c1df287aafb","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["b28c4187fedd4da4f87f1f5cc104bb0ce438f1ace484164398e07c1df287aafb"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b28c4187fedd4da4f87f1f5cc104bb0ce438f1ace484164398e07c1df287aafb\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.690Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d","routeRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b62e52d86f1bf660ead5a7b5bc7970106c2d12f5fe9ef53273ad3335e6b8d2af","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["b62e52d86f1bf660ead5a7b5bc7970106c2d12f5fe9ef53273ad3335e6b8d2af"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b62e52d86f1bf660ead5a7b5bc7970106c2d12f5fe9ef53273ad3335e6b8d2af\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.783Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.799Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d","routeRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"6b17c98b789e395fcd57bd1318da4683a39af379b2a2d7299f1928881a9cd898","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["6b17c98b789e395fcd57bd1318da4683a39af379b2a2d7299f1928881a9cd898"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"6b17c98b789e395fcd57bd1318da4683a39af379b2a2d7299f1928881a9cd898\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.895Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.900Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-bbeb7d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-07-21T16:19:13Z","generation":2,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8cc2df7b-ce2e-4026-9b68-135049ef09d3\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:targetRefs":{}}},"manager":"manager","operation":"Update","time":"2026-07-21T16:20:14Z"}],"name":"kuadrant-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-bbeb7d","uid":"8cc2df7b-ce2e-4026-9b68-135049ef09d3"}],"resourceVersion":"80572","uid":"2e1368ab-e1cd-456d-a2bc-4bce674e7bfd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"allow_on_headers_stop_iteration":true,"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"0c8fef12b9b6dece29a0b5705c122f64654763d9285853019c0dbab94b26ad98\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"0a3e1f1bc5bc4e9fb7b4ea52c6a470e14f64ad2c37f64a6e607efb8c0a7ec2f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"2612ebcc154b94ffa38d1651987e393ef6fa865c9105b8f85b8ce7970dff3d66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"0df1c50e52b6f8ba0c31789a210726550bf8e60700fc8e93d5a78d24e4e842d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"1d59e4c9d3fa3e8c947d2a467ff477eed8c6c8209ec00bfca4294dee45fa203c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"77678ab696a043420028251ef312989e3e60e8c2cb3ff9cc172f16b365040c6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4aaf2143d0561256128091bcee3dc3bc5573685f9b3cdae4c8dfe468bdf8020e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"2c4da5f936755f259b2cd24551f935456281de1d4d0b1c99ee8cb2f4edf67109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a6da92f67b982ed932b2125a997bdb04f74c130ede9dc66d0a5672d22431026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"a40fae6226e51b94350c73984a35b9f88d9db52228fd0b43fce4abda0caa5f7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"049ed7bd42e9490576c4781bf43c685d4d91f332b30d128985ccb856d72b8704\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"6012fa95ae45677f5510c088fa0ab85e065e53be42d3befc1963597ba7131ce4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f21b2ad8c630768cb111a74b10612c6cb735c81a88d81da90208b79fcea29277\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"e50a1f4c7d9b5928fcc3503bc25dfcba11f58dd0aa789d3caf0b2de560579b11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7877a1673b2885383670bfb16ba3033798e35da761faee4e8835b3fd86c9c0a1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"4f5ef06554de86565f1d2bcf61b7561a3bc5d71e4d3d88664d3d633dcb75ab89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"650dba8eb0a60a6b13d0889e7c69576c32c6dd7e469db542563eaab9dc12441f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"d2c7e6d6ac5e661ee28578ea377d51eb89ce5051d7c07327d777cfa0fcaa3f7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b62e52d86f1bf660ead5a7b5bc7970106c2d12f5fe9ef53273ad3335e6b8d2af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"82f7c162ce6b5af7424272af838c0ea4c34a431afe53d78c6a1645ecc5eb5d8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b17c98b789e395fcd57bd1318da4683a39af379b2a2d7299f1928881a9cd898\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"2f443594dddcd77149bcfe9534ecaee49a03ff9bbedca351abb5f582041bd9b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b28c4187fedd4da4f87f1f5cc104bb0ce438f1ace484164398e07c1df287aafb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_b19562_auth_test_model_bbeb7d_tokens__4c34dde7\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-b19562@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"f89f63d98ccf0a2896489efaef71d81aa5dc23790d6e613ec53471c6bb1a9a0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"200ms\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"7ac45a6326d824a9ba78552d829e7cd1477ad2385a3ca741d78deb687df54777"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-bbeb7d"}]},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:38.908Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"650dba8eb0a60a6b13d0889e7c69576c32c6dd7e469db542563eaab9dc12441f","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["650dba8eb0a60a6b13d0889e7c69576c32c6dd7e469db542563eaab9dc12441f"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"650dba8eb0a60a6b13d0889e7c69576c32c6dd7e469db542563eaab9dc12441f\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.980Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"049ed7bd42e9490576c4781bf43c685d4d91f332b30d128985ccb856d72b8704","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["049ed7bd42e9490576c4781bf43c685d4d91f332b30d128985ccb856d72b8704"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"049ed7bd42e9490576c4781bf43c685d4d91f332b30d128985ccb856d72b8704\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:38.994Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4aaf2143d0561256128091bcee3dc3bc5573685f9b3cdae4c8dfe468bdf8020e","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["4aaf2143d0561256128091bcee3dc3bc5573685f9b3cdae4c8dfe468bdf8020e"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4aaf2143d0561256128091bcee3dc3bc5573685f9b3cdae4c8dfe468bdf8020e\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:39.092Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"7877a1673b2885383670bfb16ba3033798e35da761faee4e8835b3fd86c9c0a1","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["7877a1673b2885383670bfb16ba3033798e35da761faee4e8835b3fd86c9c0a1"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"7877a1673b2885383670bfb16ba3033798e35da761faee4e8835b3fd86c9c0a1\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:39.105Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:39.119Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","route":"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route","routeRule":"rule-7","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route#rule-7"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"f21b2ad8c630768cb111a74b10612c6cb735c81a88d81da90208b79fcea29277","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["f21b2ad8c630768cb111a74b10612c6cb735c81a88d81da90208b79fcea29277"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-b-bbeb7d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? request.headers[\"x-gateway-model-name\"]   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"f21b2ad8c630768cb111a74b10612c6cb735c81a88d81da90208b79fcea29277\" already exists"}
{"level":"error","ts":"2026-07-21T16:20:39.129Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-bbeb7d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-bbeb7d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:39.180Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-bbeb7d","namespace":"ai-tenant-e2e-shared-b-bbeb7d","uid":"0b768d10-68a3-4ab8-a91c-63afc0a1686c","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-bbeb7d\" not found"}
{"level":"error","ts":"2026-07-21T16:20:39.204Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","uid":"a1837cc6-d4e7-4f43-bef3-a68605133776","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:39.208Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-524b80","namespace":"ai-tenant-e2e-shared-a-524b80","uid":"3f74a8c5-0a5f-4af3-9e83-a049b507943f","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-524b80\" not found"}
{"level":"error","ts":"2026-07-21T16:20:39.209Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-524b80-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-524b80-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:39.225Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-bbeb7d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:39.286Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"maas-api-route-e2e-shared-b-bbeb7d","namespace":"odh-ai-gateway-infra","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"maas-api-route-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:39.297Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-bbeb7d-kserve-route","namespace":"ai-tenant-e2e-shared-b-bbeb7d","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-bbeb7d-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:20:41.781Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","EnvoyFilter","HTTPRoute","AuthPolicy","ConfigMap","Limitador","TokenRateLimitPolicy","Gateway"],"eventTypes":{"create":13,"delete":2,"update":9}}
{"level":"info","ts":"2026-07-21T16:20:41.794Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:41.883Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:20:42.180Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:20:42.180Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:42.482Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:42.484Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:42.485Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:42.485Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:42.482Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:42.580Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:42.585Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:43.301Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:43.301Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:45.883Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["EnvoyFilter","HTTPRoute","TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"create":1,"update":9}}
{"level":"info","ts":"2026-07-21T16:20:45.900Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:46.188Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:20:46.380Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:20:46.380Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:46.586Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:46.587Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:46.587Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:46.592Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:46.593Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:46.594Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-21T16:20:46.600Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:20:46.600Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:47.318Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:47.318Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:51.190Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","ConfigMap","EnvoyFilter","Limitador"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-21T16:20:51.208Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:51.582Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:20:51.690Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:20:51.690Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:51.888Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:51.888Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:51.890Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:51.980Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:51.981Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:51.981Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:51.985Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:52.650Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:52.650Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:53.082Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":1}}
{"level":"info","ts":"2026-07-21T16:20:53.788Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:53.788Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:53.788Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:53.881Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-21T16:20:53.888Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:20:53.888Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-21T16:20:54.304Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-bbeb7d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-07-21T16:19:13Z","generation":4,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8cc2df7b-ce2e-4026-9b68-135049ef09d3\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:targetRefs":{}}},"manager":"manager","operation":"Update","time":"2026-07-21T16:20:42Z"}],"name":"kuadrant-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-bbeb7d","uid":"8cc2df7b-ce2e-4026-9b68-135049ef09d3"}],"resourceVersion":"81085","uid":"2e1368ab-e1cd-456d-a2bc-4bce674e7bfd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"allow_on_headers_stop_iteration":true,"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"0c8fef12b9b6dece29a0b5705c122f64654763d9285853019c0dbab94b26ad98\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"0a3e1f1bc5bc4e9fb7b4ea52c6a470e14f64ad2c37f64a6e607efb8c0a7ec2f0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/chat/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"2612ebcc154b94ffa38d1651987e393ef6fa865c9105b8f85b8ce7970dff3d66\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"0df1c50e52b6f8ba0c31789a210726550bf8e60700fc8e93d5a78d24e4e842d5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/completions'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"1d59e4c9d3fa3e8c947d2a467ff477eed8c6c8209ec00bfca4294dee45fa203c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses/'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"77678ab696a043420028251ef312989e3e60e8c2cb3ff9cc172f16b365040c6f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path == '/v1/responses'\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4aaf2143d0561256128091bcee3dc3bc5573685f9b3cdae4c8dfe468bdf8020e\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"2c4da5f936755f259b2cd24551f935456281de1d4d0b1c99ee8cb2f4edf67109\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d/v1/chat/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"3a6da92f67b982ed932b2125a997bdb04f74c130ede9dc66d0a5672d22431026\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"a40fae6226e51b94350c73984a35b9f88d9db52228fd0b43fce4abda0caa5f7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d/v1/completions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"049ed7bd42e9490576c4781bf43c685d4d91f332b30d128985ccb856d72b8704\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"6012fa95ae45677f5510c088fa0ab85e065e53be42d3befc1963597ba7131ce4\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d/v1/responses')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"f21b2ad8c630768cb111a74b10612c6cb735c81a88d81da90208b79fcea29277\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"e50a1f4c7d9b5928fcc3503bc25dfcba11f58dd0aa789d3caf0b2de560579b11\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7877a1673b2885383670bfb16ba3033798e35da761faee4e8835b3fd86c9c0a1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"4f5ef06554de86565f1d2bcf61b7561a3bc5d71e4d3d88664d3d633dcb75ab89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"650dba8eb0a60a6b13d0889e7c69576c32c6dd7e469db542563eaab9dc12441f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"d2c7e6d6ac5e661ee28578ea377d51eb89ce5051d7c07327d777cfa0fcaa3f7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b62e52d86f1bf660ead5a7b5bc7970106c2d12f5fe9ef53273ad3335e6b8d2af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"82f7c162ce6b5af7424272af838c0ea4c34a431afe53d78c6a1645ecc5eb5d8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b17c98b789e395fcd57bd1318da4683a39af379b2a2d7299f1928881a9cd898\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"2f443594dddcd77149bcfe9534ecaee49a03ff9bbedca351abb5f582041bd9b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b28c4187fedd4da4f87f1f5cc104bb0ce438f1ace484164398e07c1df287aafb\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.ai_tenant_e2e_shared_b_bbeb7d_e2e_auth_iso_811bb8_auth_test_model_bbeb7d_tokens__738a8e0f\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"auth.identity.selected_subscription_key == \\\"ai-tenant-e2e-shared-b-bbeb7d/e2e-auth-iso-811bb8@ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d\\\" && !request.path.endsWith(\\\"/v1/models\\\")\"]}],\"scope\":\"ai-tenant-e2e-shared-b-bbeb7d/auth-test-model-bbeb7d-kserve-route\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-bbeb7d/maas-trlp-auth-test-model-bbeb7d\"]}],\"name\":\"f89f63d98ccf0a2896489efaef71d81aa5dc23790d6e613ec53471c6bb1a9a0c\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/')\",\"request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-bbeb7d/models/facebook/opt-125m')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"200ms\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"7ac45a6326d824a9ba78552d829e7cd1477ad2385a3ca741d78deb687df54777"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-bbeb7d"}]},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:54.403Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","uid":"a1837cc6-d4e7-4f43-bef3-a68605133776","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:54.426Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-bbeb7d","namespace":"ai-tenant-e2e-shared-b-bbeb7d","uid":"8be45a43-4d53-4a46-a18c-20f853bc558f","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:20:54.493Z","logger":"kuadrant-operator.RoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-bbeb7d-kserve-route","namespace":"ai-tenant-e2e-shared-b-bbeb7d","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"auth-test-model-bbeb7d-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:20:58.280Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","EnvoyFilter","HTTPRoute","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"delete":2,"update":5}}
{"level":"info","ts":"2026-07-21T16:20:58.299Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:58.308Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:20:58.581Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:20:58.581Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:58.689Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:20:58.780Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:58.781Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:20:58.783Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:58.783Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:58.785Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-21T16:20:58.788Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:20:58.789Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:59.336Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:20:59.336Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:20:59.489Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-07-21T16:21:00.087Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:00.088Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:00.088Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:00.180Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:00.180Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:00.181Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-21T16:21:00.187Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ad9708cf688b97f9cc04b99807901d3d9df11bf838ea78d9c271789e0cb6650f","error":"authconfigs.authorino.kuadrant.io \"ad9708cf688b97f9cc04b99807901d3d9df11bf838ea78d9c271789e0cb6650f\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.188Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:21:00.188Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-21T16:21:00.191Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f21b2ad8c630768cb111a74b10612c6cb735c81a88d81da90208b79fcea29277","error":"authconfigs.authorino.kuadrant.io \"f21b2ad8c630768cb111a74b10612c6cb735c81a88d81da90208b79fcea29277\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.195Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43","error":"authconfigs.authorino.kuadrant.io \"e6f52e2a36429dc94a070099375c4c991a2ca2ebd5a029e6a5c7ea14e6d42a43\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.385Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e","error":"authconfigs.authorino.kuadrant.io \"cbb41914fec86f704ada0bbf258ea8508943e835ec46005d310efa92b7438d4e\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.388Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bfce006fd6f6709e670c4aca77baa7990b580109a93ac48cbcad97bfd1def161","error":"authconfigs.authorino.kuadrant.io \"bfce006fd6f6709e670c4aca77baa7990b580109a93ac48cbcad97bfd1def161\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.393Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/de5294cfa4d6b945a030d5fbc27599a3274094c38dff9dc3dabac33c29c53ff8","error":"authconfigs.authorino.kuadrant.io \"de5294cfa4d6b945a030d5fbc27599a3274094c38dff9dc3dabac33c29c53ff8\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.396Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/057b8a2c4c6e92b9c554feddb4986998a3ab6c5510a6e8821907a4f5eb1cb952","error":"authconfigs.authorino.kuadrant.io \"057b8a2c4c6e92b9c554feddb4986998a3ab6c5510a6e8821907a4f5eb1cb952\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.480Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176","error":"authconfigs.authorino.kuadrant.io \"f5de2f25e582571bfa6803ed947f375b9b324c8b72e97dd8c5b47f20166e7176\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.480Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-a-524b80","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-07-21T16:19:04Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"42046b73-4be1-4256-9755-594aad3a210b\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:targetRefs":{}}},"manager":"manager","operation":"Update","time":"2026-07-21T16:20:47Z"}],"name":"kuadrant-e2e-shared-a-524b80","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-524b80","uid":"42046b73-4be1-4256-9755-594aad3a210b"}],"resourceVersion":"81145","uid":"5bd50cb6-8bd3-42da-bb35-8e2faf664116"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"allow_on_headers_stop_iteration":true,"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4ea1df911dd48c8608f45c3b081f764000aea5245116e1a5718f68dba04095f3\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-524b80-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"7c15181436d05615b42f0f5fe6c9e20c60b26a9e2275e5cb71cb925f66a6d363\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"0dc5703449944e1156040120d471565aab8321b9ffd91554b409c50bbbdb5fa5\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-524b80-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"9cecb280fb2c50d87027886279beb8df39d9be1bbc84159c99535ff2f660f9a5\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"831d71dbd13bb3edd44e31e3635ca6426178087bb6b9ffd62648f505154e8ed4\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-524b80-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"10e44e0a4d893201b7c9fc4d74d716e72662331ccc2351e69479390a85d099e7\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"4fdc633b816cf21086424d7452cd3f9989dd9f2b677531932d5e71a926f812a7\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-524b80-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__f0abd0df\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-a-524b80\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-524b80\"]}],\"name\":\"ae903e97aea52c26598a31361c6d35f37569dfe58305f0120e1e3279a42637dc\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"200ms\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"7ac45a6326d824a9ba78552d829e7cd1477ad2385a3ca741d78deb687df54777"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-524b80"}]},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:21:00.484Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3a6da92f67b982ed932b2125a997bdb04f74c130ede9dc66d0a5672d22431026","error":"authconfigs.authorino.kuadrant.io \"3a6da92f67b982ed932b2125a997bdb04f74c130ede9dc66d0a5672d22431026\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.488Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f288e9014b6bf08be4c53a8fa332c68daf3d5a2f0a62350f476110cce8694a10","error":"authconfigs.authorino.kuadrant.io \"f288e9014b6bf08be4c53a8fa332c68daf3d5a2f0a62350f476110cce8694a10\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.492Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9fe572c32cc1d911dfe06500024c2481686be06a2558c6a7949b76db0cded426","error":"authconfigs.authorino.kuadrant.io \"9fe572c32cc1d911dfe06500024c2481686be06a2558c6a7949b76db0cded426\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.495Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/4aaf2143d0561256128091bcee3dc3bc5573685f9b3cdae4c8dfe468bdf8020e","error":"authconfigs.authorino.kuadrant.io \"4aaf2143d0561256128091bcee3dc3bc5573685f9b3cdae4c8dfe468bdf8020e\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.496Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update envoyfilter object","gateway":"openshift-ingress/e2e-shared-b-bbeb7d","envoyfilter":{"apiVersion":"networking.istio.io/v1alpha3","kind":"EnvoyFilter","metadata":{"creationTimestamp":"2026-07-21T16:19:13Z","generation":5,"labels":{"kuadrant.io/managed":"true","kuadrant.io/wasm":"true"},"managedFields":[{"apiVersion":"networking.istio.io/v1alpha3","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{},"f:kuadrant.io/wasm":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"8cc2df7b-ce2e-4026-9b68-135049ef09d3\"}":{}}},"f:spec":{".":{},"f:configPatches":{},"f:targetRefs":{}}},"manager":"manager","operation":"Update","time":"2026-07-21T16:20:52Z"}],"name":"kuadrant-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-bbeb7d","uid":"8cc2df7b-ce2e-4026-9b68-135049ef09d3"}],"resourceVersion":"81219","uid":"2e1368ab-e1cd-456d-a2bc-4bce674e7bfd"},"spec":{"configPatches":[{"applyTo":"HTTP_FILTER","match":{"context":"GATEWAY","listener":{"filterChain":{"filter":{"name":"envoy.filters.network.http_connection_manager","subFilter":{"name":"envoy.filters.http.router"}}}}},"patch":{"operation":"INSERT_BEFORE","value":{"name":"envoy.filters.http.wasm","typed_config":{"@type":"type.googleapis.com/udpa.type.v1.TypedStruct","type_url":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm","value":{"config":{"allow_on_headers_stop_iteration":true,"configuration":{"@type":"type.googleapis.com/google.protobuf.StringValue","value":"{\"actionSets\":[{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"7877a1673b2885383670bfb16ba3033798e35da761faee4e8835b3fd86c9c0a1\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"4f5ef06554de86565f1d2bcf61b7561a3bc5d71e4d3d88664d3d633dcb75ab89\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/subscriptions')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"650dba8eb0a60a6b13d0889e7c69576c32c6dd7e469db542563eaab9dc12441f\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"d2c7e6d6ac5e661ee28578ea377d51eb89ce5051d7c07327d777cfa0fcaa3f7b\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/api-keys')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"b62e52d86f1bf660ead5a7b5bc7970106c2d12f5fe9ef53273ad3335e6b8d2af\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"82f7c162ce6b5af7424272af838c0ea4c34a431afe53d78c6a1645ecc5eb5d8f\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/v1/models')\"]}},{\"actions\":[{\"predicates\":[\"request.path != \\\"/maas-api/health\\\" || request.method != \\\"GET\\\"\"],\"scope\":\"6b17c98b789e395fcd57bd1318da4683a39af379b2a2d7299f1928881a9cd898\",\"service\":\"auth-service\",\"sources\":[\"authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-bbeb7d-maas-auth\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"0\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-check-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]},{\"conditionalData\":[{\"data\":[{\"expression\":{\"key\":\"tokenlimit.deny_all_by_default__cf6f1235\",\"value\":\"1\"}},{\"expression\":{\"key\":\"auth.identity.userid\",\"value\":\"auth.identity.userid\"}},{\"expression\":{\"key\":\"ratelimit.hits_addend\",\"value\":\"responseBodyJSON(\\\"/usage/total_tokens\\\")\"}}],\"predicates\":[\"!request.path.startsWith(\\\"/maas-api\\\") && !request.path.startsWith(\\\"/v1/models\\\") && !request.path.startsWith(\\\"/v1/subscriptions\\\") && !request.path.startsWith(\\\"/v1/api-keys\\\")\"]}],\"scope\":\"odh-ai-gateway-infra/maas-api-route-e2e-shared-b-bbeb7d\",\"service\":\"ratelimit-report-service\",\"sources\":[\"tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-bbeb7d\"]}],\"name\":\"2f443594dddcd77149bcfe9534ecaee49a03ff9bbedca351abb5f582041bd9b0\",\"routeRuleConditions\":{\"hostnames\":[\"*\"],\"predicates\":[\"request.url_path.startsWith('/maas-api')\"]}}],\"services\":{\"auth-service\":{\"endpoint\":\"kuadrant-auth-service\",\"failureMode\":\"deny\",\"timeout\":\"200ms\",\"type\":\"auth\"},\"ratelimit-check-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-check\"},\"ratelimit-report-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"deny\",\"timeout\":\"100ms\",\"type\":\"ratelimit-report\"},\"ratelimit-service\":{\"endpoint\":\"kuadrant-ratelimit-service\",\"failureMode\":\"allow\",\"timeout\":\"100ms\",\"type\":\"ratelimit\"}}}"},"failure_policy":"FAIL_RELOAD","name":"kuadrant-wasm-shim","root_id":"kuadrant_wasm_shim","vm_config":{"allow_precompiled":true,"code":{"remote":{"http_uri":{"cluster":"kuadrant-operator-wasm","timeout":"10s","uri":"http://kuadrant-operator-wasm.kuadrant-system.svc.cluster.local:8082/plugin.wasm"},"sha256":"7ac45a6326d824a9ba78552d829e7cd1477ad2385a3ca741d78deb687df54777"}},"runtime":"envoy.wasm.runtime.v8"}}}}}}},{"applyTo":"CLUSTER","match":{"cluster":{"service":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local"}},"patch":{"operation":"ADD","value":{"connect_timeout":"1s","http2_protocol_options":{},"lb_policy":"ROUND_ROBIN","load_assignment":{"cluster_name":"kuadrant-operator-wasm","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"address":"kuadrant-operator-wasm.kuadrant-system.svc.cluster.local","port_value":8082}}}}]}]},"name":"kuadrant-operator-wasm","type":"STRICT_DNS"}}}],"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-bbeb7d"}]},"status":{}},"error":"Operation cannot be fulfilled on envoyfilters.networking.istio.io \"kuadrant-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:21:00.499Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/b28c4187fedd4da4f87f1f5cc104bb0ce438f1ace484164398e07c1df287aafb","error":"authconfigs.authorino.kuadrant.io \"b28c4187fedd4da4f87f1f5cc104bb0ce438f1ace484164398e07c1df287aafb\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.503Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/fdf927a46727c535eca5991bd8482bef96fe786057b565bbee8e2a365574c758","error":"authconfigs.authorino.kuadrant.io \"fdf927a46727c535eca5991bd8482bef96fe786057b565bbee8e2a365574c758\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.506Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7bdcad693d4ef92774162b94c259f73faa6bb95a4bf874be2e82bcf46eb27c6b","error":"authconfigs.authorino.kuadrant.io \"7bdcad693d4ef92774162b94c259f73faa6bb95a4bf874be2e82bcf46eb27c6b\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.509Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/049ed7bd42e9490576c4781bf43c685d4d91f332b30d128985ccb856d72b8704","error":"authconfigs.authorino.kuadrant.io \"049ed7bd42e9490576c4781bf43c685d4d91f332b30d128985ccb856d72b8704\" not found"}
{"level":"error","ts":"2026-07-21T16:21:00.618Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-524b80","namespace":"openshift-ingress","uid":"c4a46aa7-be23-49ea-b347-a587feb7d3bc","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-21T16:21:00.687Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-bbeb7d","namespace":"openshift-ingress","uid":"a1837cc6-d4e7-4f43-bef3-a68605133776","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-bbeb7d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:21:00.697Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:00.697Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:02.689Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","ConfigMap","EnvoyFilter","AuthConfig"],"eventTypes":{"delete":16,"update":6}}
{"level":"info","ts":"2026-07-21T16:21:02.712Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:02.880Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:21:03.087Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:21:03.087Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:03.187Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:03.188Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:21:03.190Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:03.190Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:03.280Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:03.314Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:03.650Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:03.650Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:05.689Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-07-21T16:21:05.705Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:06.085Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:21:06.183Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:21:06.183Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:06.283Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:06.283Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:06.284Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:21:06.284Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:06.333Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:06.333Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:07.288Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-21T16:21:07.304Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:07.592Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:21:07.781Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:21:07.781Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:07.889Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:07.890Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:21:07.890Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:07.890Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:07.891Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:07.891Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-21T16:21:08.222Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-524b80","namespace":"openshift-ingress","uid":"c4a46aa7-be23-49ea-b347-a587feb7d3bc","error":"tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-524b80\" not found"}
{"level":"info","ts":"2026-07-21T16:21:08.230Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:08.230Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"error","ts":"2026-07-21T16:21:08.386Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-524b80","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-524b80\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-21T16:21:10.292Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-07-21T16:21:10.789Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:10.789Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:10.793Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:10.880Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:10.788Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:10.881Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:21:10.893Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:11.299Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:11.299Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:13.289Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador","AuthPolicy","Gateway","EnvoyFilter","AuthConfig"],"eventTypes":{"delete":7,"update":7}}
{"level":"info","ts":"2026-07-21T16:21:13.380Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:13.386Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:21:13.681Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:21:13.681Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:13.883Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:13.884Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:13.884Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:13.887Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:13.888Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:21:13.888Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:13.888Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:14.243Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:14.244Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:15.288Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-21T16:21:15.381Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:15.387Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:21:15.580Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:21:15.580Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:15.591Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:15.592Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:21:15.592Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:15.592Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:15.592Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:21:15.592Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:21:16.129Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:21:16.129Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:05.293Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Gateway"],"eventTypes":{"delete":2,"update":1}}
{"level":"info","ts":"2026-07-21T16:24:05.783Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:24:05.784Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:05.785Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:24:05.785Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:05.786Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:05.786Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:05.786Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:24:06.126Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:06.126Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:16.092Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute","TokenRateLimitPolicy"],"eventTypes":{"delete":2,"update":2}}
{"level":"info","ts":"2026-07-21T16:24:16.384Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:24:16.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:16.482Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-21T16:24:16.484Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:16.484Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:16.580Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:24:16.584Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:16.919Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:16.919Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:18.686Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","Gateway","ConfigMap","Limitador","EnvoyFilter","AuthConfig"],"eventTypes":{"delete":7,"update":6}}
{"level":"info","ts":"2026-07-21T16:24:18.697Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:18.702Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:24:18.887Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:24:18.887Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:18.888Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:24:18.888Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:18.888Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:18.980Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:18.980Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:24:18.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:24:18.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:19.408Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:19.408Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:20.292Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador","TokenRateLimitPolicy"],"eventTypes":{"update":4}}
{"level":"info","ts":"2026-07-21T16:24:20.303Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:20.781Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-21T16:24:20.788Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-21T16:24:20.788Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:20.790Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:20.791Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:24:20.791Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:20.880Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:20.880Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:24:20.884Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:24:21.188Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:24:21.188Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-21T16:27:11.985Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Gateway"],"eventTypes":{"delete":2,"update":1}}
{"level":"info","ts":"2026-07-21T16:27:12.286Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:27:12.287Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-21T16:27:12.287Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-21T16:27:12.290Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-21T16:27:12.291Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-21T16:27:12.291Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-21T16:27:12.380Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-21T16:27:12.711Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-21T16:27:12.712Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}