{"level":"debug","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e4324c738fcacf67cb924d83de2c30d6821513243076e3d033e5495cccf0fd85","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e4324c738fcacf67cb924d83de2c30d6821513243076e3d033e5495cccf0fd85"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d274e6ab0d799e9a428722ea3e360b3237d42565c2aa47e51527c9603ff0aeb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d274e6ab0d799e9a428722ea3e360b3237d42565c2aa47e51527c9603ff0aeb"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01f89415cd48169b2c9f2a748d32ed2157a22f5beae1844ee67df67af9506bcd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01f89415cd48169b2c9f2a748d32ed2157a22f5beae1844ee67df67af9506bcd"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2719c60c8756ae394a9090ac7224426e90ed94e126b80cedd5d96d5da38f8058","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2719c60c8756ae394a9090ac7224426e90ed94e126b80cedd5d96d5da38f8058"}
{"level":"info","ts":"2026-07-13T07:49:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b0c1b7bfde9ad3f995e6230c4f5e9309132773d49e0b4ab341c2871e10c5c393","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b0c1b7bfde9ad3f995e6230c4f5e9309132773d49e0b4ab341c2871e10c5c393"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e52d07764889b71626509fdbe50033d731fb5aac74d71c78097e27087a86fd21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T07:49:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"acfe5afcb12d8baea221902c00f64740aba0c9f67335fd2266e28e8bd9d6c9d5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cd944f0ace1ac075fdc7050ee2d458c0677b88ff69033f768cf5db397cea364","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e52d07764889b71626509fdbe50033d731fb5aac74d71c78097e27087a86fd21"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"218b40f9fecd085e0d04914b8c23ecfa2fcfa88921cbfb05f7ce65e6e80e4519","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6704fd2726669fb9382494ad01439e58802a2e5b3f7dd80f0c2036e13f28e5c6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acfe5afcb12d8baea221902c00f64740aba0c9f67335fd2266e28e8bd9d6c9d5"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e80fd4e8b6006438f83b7b4a1dca05e209da6e292d23c3edcbd8d5c411585409","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cd944f0ace1ac075fdc7050ee2d458c0677b88ff69033f768cf5db397cea364"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9334047764ba3eca7e7a64a3aaf8cc728de78082b992c1849e61ac8a03fd11e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8f761003b7de1d837e4be36fcdb508f16c40f966238d476984f47ed956624d9a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/218b40f9fecd085e0d04914b8c23ecfa2fcfa88921cbfb05f7ce65e6e80e4519"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6704fd2726669fb9382494ad01439e58802a2e5b3f7dd80f0c2036e13f28e5c6"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4bacf61c4c614c29d9059d9529b927cbaebe7ca1cd6f898d744ebcf27d946b45","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3571f1469fac10374a77a988ea521cc5e8b0a7f36c465c2bf58445161e65cea4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e80fd4e8b6006438f83b7b4a1dca05e209da6e292d23c3edcbd8d5c411585409"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9334047764ba3eca7e7a64a3aaf8cc728de78082b992c1849e61ac8a03fd11e4"}
{"level":"debug","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0106ec8bd33271f0631bb4e14ce8d7aa34536a7ad8750d46a6c3753e8f87e1e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8f761003b7de1d837e4be36fcdb508f16c40f966238d476984f47ed956624d9a"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4bacf61c4c614c29d9059d9529b927cbaebe7ca1cd6f898d744ebcf27d946b45"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3571f1469fac10374a77a988ea521cc5e8b0a7f36c465c2bf58445161e65cea4"}
{"level":"info","ts":"2026-07-13T07:49:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0106ec8bd33271f0631bb4e14ce8d7aa34536a7ad8750d46a6c3753e8f87e1e6"}
{"level":"info","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39508","PortSpecifier":{"PortValue":39508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39508","PortSpecifier":{"PortValue":39508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783928994,"nanos":728815115},"http":{"id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"]}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8f761003b7de1d837e4be36fcdb508f16c40f966238d476984f47ed956624d9a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1d8f06ed-2ce8-4894-88b5-6fcbdf0cc49a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60978","PortSpecifier":{"PortValue":60978}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d95a9e06-461c-4438-85da-7c82c7a50c28","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60978","PortSpecifier":{"PortValue":60978}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783928994,"nanos":777809305},"http":{"id":"d95a9e06-461c-4438-85da-7c82c7a50c28","method":"POST","headers":{":authority":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"]}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4bacf61c4c614c29d9059d9529b927cbaebe7ca1cd6f898d744ebcf27d946b45"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.46:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-da56f9/rate-test-model-da56f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d95a9e06-461c-4438-85da-7c82c7a50c28","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39522","PortSpecifier":{"PortValue":39522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1691e555-3fe9-4d90-b86f-855766f48dd4","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39522","PortSpecifier":{"PortValue":39522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783928994,"nanos":817597757},"http":{"id":"1691e555-3fe9-4d90-b86f-855766f48dd4","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-136tRJN2jHbiU8FiF_vk6toCbrB3DyzIQHlZxzRd9CVHfKP2YsRbdIgYfd5fZ"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-136tRJN2jHbiU8FiF_vk6toCbrB3DyzIQHlZxzRd9CVHfKP2YsRbdIgYfd5fZ\"}"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","keyName":"e2e-rate-a-1f548e","subscription":"e2e-rate-iso-a-1f548e","tenant":"e2e-shared-a-db7d2d","userId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-1f548e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1f548e","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1f548e"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","keyName":"e2e-rate-a-1f548e","selected_subscription":"e2e-rate-iso-a-1f548e","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-1f548e@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1f548e","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:49:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1691e555-3fe9-4d90-b86f-855766f48dd4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39532","PortSpecifier":{"PortValue":39532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39532","PortSpecifier":{"PortValue":39532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783928995,"nanos":874095309},"http":{"id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-136tRJN2jHbiU8FiF_vk6toCbrB3DyzIQHlZxzRd9CVHfKP2YsRbdIgYfd5fZ"}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-136tRJN2jHbiU8FiF_vk6toCbrB3DyzIQHlZxzRd9CVHfKP2YsRbdIgYfd5fZ\"}"}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","keyName":"e2e-rate-a-1f548e","subscription":"e2e-rate-iso-a-1f548e","tenant":"e2e-shared-a-db7d2d","userId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-1f548e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1f548e","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1f548e"}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","keyName":"e2e-rate-a-1f548e","selected_subscription":"e2e-rate-iso-a-1f548e","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-1f548e@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1f548e","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:49:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d49d9388-45b9-47ef-ac26-bc9a60a77c0a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39536","PortSpecifier":{"PortValue":39536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4f5e5022-7b5b-46a8-981f-600e2325a740","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39536","PortSpecifier":{"PortValue":39536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783928996,"nanos":914247653},"http":{"id":"4f5e5022-7b5b-46a8-981f-600e2325a740","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-136tRJN2jHbiU8FiF_vk6toCbrB3DyzIQHlZxzRd9CVHfKP2YsRbdIgYfd5fZ"}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-136tRJN2jHbiU8FiF_vk6toCbrB3DyzIQHlZxzRd9CVHfKP2YsRbdIgYfd5fZ\"}"}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","keyName":"e2e-rate-a-1f548e","subscription":"e2e-rate-iso-a-1f548e","tenant":"e2e-shared-a-db7d2d","userId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-1f548e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1f548e","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1f548e"}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3af2cd4c-ea27-498b-b840-dc57888e69aa","keyName":"e2e-rate-a-1f548e","selected_subscription":"e2e-rate-iso-a-1f548e","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-1f548e@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1f548e","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:49:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f5e5022-7b5b-46a8-981f-600e2325a740","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59182","PortSpecifier":{"PortValue":59182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59182","PortSpecifier":{"PortValue":59182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929003,"nanos":637685568},"http":{"id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"]}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8f761003b7de1d837e4be36fcdb508f16c40f966238d476984f47ed956624d9a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2d07fbf-462b-4dcc-aa69-cecaf53be07a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33270","PortSpecifier":{"PortValue":33270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33270","PortSpecifier":{"PortValue":33270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929003,"nanos":708411508},"http":{"id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","method":"POST","headers":{":authority":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"]}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/29a38588247b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4add8de9-face-4c78-b329-0e0016db67d9"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f58aa03d-a15b-42c1-9704-849dc2b702e1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4bacf61c4c614c29d9059d9529b927cbaebe7ca1cd6f898d744ebcf27d946b45"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.46:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-da56f9/rate-test-model-da56f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac62c9ef-87df-408f-86ac-c9b7ebf5525a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59192","PortSpecifier":{"PortValue":59192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3edc99e2-066a-4186-9520-b161d48a8e80","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59192","PortSpecifier":{"PortValue":59192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929003,"nanos":752997565},"http":{"id":"3edc99e2-066a-4186-9520-b161d48a8e80","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3edc99e2-066a-4186-9520-b161d48a8e80","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59204","PortSpecifier":{"PortValue":59204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59204","PortSpecifier":{"PortValue":59204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929004,"nanos":801417640},"http":{"id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab3c30c3-dd5e-4cfc-8762-c3fd7a056c7e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59216","PortSpecifier":{"PortValue":59216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59216","PortSpecifier":{"PortValue":59216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929005,"nanos":845884622},"http":{"id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd8261b4-b55c-4435-9693-3bc9d409fcbc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59222","PortSpecifier":{"PortValue":59222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59222","PortSpecifier":{"PortValue":59222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929006,"nanos":888397600},"http":{"id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f2f5141-5bbf-4ade-bd95-4e148f5f3be0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34218","PortSpecifier":{"PortValue":34218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e17808fa-ad44-4b4d-92bd-360e64722037","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34218","PortSpecifier":{"PortValue":34218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929007,"nanos":937464490},"http":{"id":"e17808fa-ad44-4b4d-92bd-360e64722037","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e17808fa-ad44-4b4d-92bd-360e64722037","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34228","PortSpecifier":{"PortValue":34228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d1243438-c89b-429e-9f81-b0200fdad4b5","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34228","PortSpecifier":{"PortValue":34228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929008,"nanos":985060557},"http":{"id":"d1243438-c89b-429e-9f81-b0200fdad4b5","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1243438-c89b-429e-9f81-b0200fdad4b5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34240","PortSpecifier":{"PortValue":34240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34240","PortSpecifier":{"PortValue":34240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929010,"nanos":22146924},"http":{"id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46bbc558-2846-4347-a0ac-06f5d20fc9d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2236004e-7ae3-4574-9872-f369372b68f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34250","PortSpecifier":{"PortValue":34250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2236004e-7ae3-4574-9872-f369372b68f4","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2236004e-7ae3-4574-9872-f369372b68f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34250","PortSpecifier":{"PortValue":34250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929011,"nanos":57236657},"http":{"id":"2236004e-7ae3-4574-9872-f369372b68f4","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2236004e-7ae3-4574-9872-f369372b68f4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2236004e-7ae3-4574-9872-f369372b68f4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2236004e-7ae3-4574-9872-f369372b68f4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2236004e-7ae3-4574-9872-f369372b68f4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929012,"nanos":95479971},"http":{"id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01a0b836-a429-47ae-a5a6-0fc7451e3a2b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34268","PortSpecifier":{"PortValue":34268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f362356a-6ac2-4290-8270-dc71b1f3b660","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34268","PortSpecifier":{"PortValue":34268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929013,"nanos":136097983},"http":{"id":"f362356a-6ac2-4290-8270-dc71b1f3b660","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f362356a-6ac2-4290-8270-dc71b1f3b660","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34278","PortSpecifier":{"PortValue":34278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","method":"POST","path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions","host":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:34278","PortSpecifier":{"PortValue":34278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929014,"nanos":175202263},"http":{"id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","method":"POST","headers":{":authority":"e2e-shared-a-db7d2d.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Przo7U8bA7qglfZa_9TaONVO2uUy5OOYyJbMQCkkomTZ7mkAPl8dpFgqqlOG\"}"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","subscription":"e2e-rate-iso-a-708da3","tenant":"e2e-shared-a-db7d2d","userId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\",\"requestedSubscription\":\"e2e-rate-iso-a-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-db7d2d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"45c4ab47-d4c3-4fcb-b0f0-340e39c7a58b","keyName":"e2e-rate-a-708da3","selected_subscription":"e2e-rate-iso-a-708da3","selected_subscription_key":"ai-tenant-e2e-shared-a-db7d2d/e2e-rate-iso-a-708da3@ai-tenant-e2e-shared-a-db7d2d/rate-test-model-db7d2d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-db7d2d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-708da3","namespace":"ai-tenant-e2e-shared-a-db7d2d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e75d3be1-2ac0-434d-a25d-358b1320ec63","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51168","PortSpecifier":{"PortValue":51168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a172ea6e-ed45-4804-8127-d87e3a127bff","method":"POST","path":"/ai-tenant-e2e-shared-b-da56f9/rate-test-model-da56f9/v1/completions","host":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51168","PortSpecifier":{"PortValue":51168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783929014,"nanos":217193697},"http":{"id":"a172ea6e-ed45-4804-8127-d87e3a127bff","method":"POST","headers":{":authority":"e2e-shared-b-da56f9.apps.359df62d-94a9-4158-b718-29a38588247b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-da56f9/rate-test-model-da56f9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-19afQqv82m92g5Uok_FjRli382OQ92aNoc0gSUiTDnaU1SSbXFS1SOIn7ZYcq"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-da56f9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-19afQqv82m92g5Uok_FjRli382OQ92aNoc0gSUiTDnaU1SSbXFS1SOIn7ZYcq\"}"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-da56f9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e78cddce-e1ff-4b5c-b8a5-a40b4513db0c","keyName":"e2e-rate-b-708da3","subscription":"e2e-rate-iso-b-708da3","tenant":"e2e-shared-b-da56f9","userId":"e78cddce-e1ff-4b5c-b8a5-a40b4513db0c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-da56f9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-da56f9/rate-test-model-da56f9\",\"requestedSubscription\":\"e2e-rate-iso-b-708da3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-da56f9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-da56f9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-708da3","namespace":"ai-tenant-e2e-shared-b-da56f9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-da56f9/rate-test-model-da56f9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-708da3"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e78cddce-e1ff-4b5c-b8a5-a40b4513db0c","keyName":"e2e-rate-b-708da3","selected_subscription":"e2e-rate-iso-b-708da3","selected_subscription_key":"ai-tenant-e2e-shared-b-da56f9/e2e-rate-iso-b-708da3@ai-tenant-e2e-shared-b-da56f9/rate-test-model-da56f9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-da56f9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-708da3","namespace":"ai-tenant-e2e-shared-b-da56f9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T07:50:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a172ea6e-ed45-4804-8127-d87e3a127bff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T07:50:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/acfe5afcb12d8baea221902c00f64740aba0c9f67335fd2266e28e8bd9d6c9d5"}
{"level":"info","ts":"2026-07-13T07:50:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e52d07764889b71626509fdbe50033d731fb5aac74d71c78097e27087a86fd21"}
{"level":"info","ts":"2026-07-13T07:50:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8f761003b7de1d837e4be36fcdb508f16c40f966238d476984f47ed956624d9a"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01f89415cd48169b2c9f2a748d32ed2157a22f5beae1844ee67df67af9506bcd"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2719c60c8756ae394a9090ac7224426e90ed94e126b80cedd5d96d5da38f8058"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3571f1469fac10374a77a988ea521cc5e8b0a7f36c465c2bf58445161e65cea4"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7420b3b488d9cba9c43fe6054b7334362b419573f5efa151d8af983fc363d96"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/218b40f9fecd085e0d04914b8c23ecfa2fcfa88921cbfb05f7ce65e6e80e4519"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e4324c738fcacf67cb924d83de2c30d6821513243076e3d033e5495cccf0fd85"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4d274e6ab0d799e9a428722ea3e360b3237d42565c2aa47e51527c9603ff0aeb"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4cd944f0ace1ac075fdc7050ee2d458c0677b88ff69033f768cf5db397cea364"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7a1d84d8fb5e489c681906098ef1a93a51b4c0ac4167aedd1ba084879ed3e928"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e80fd4e8b6006438f83b7b4a1dca05e209da6e292d23c3edcbd8d5c411585409"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b324fdd0755637d447a3e5d88297c102bb6cca15cfd106b6da8676a9eca6c8e4"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6457d536a55f4b66caffe1f9dad8a34ba6cc091e88017c73a873562f176a5be3"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6704fd2726669fb9382494ad01439e58802a2e5b3f7dd80f0c2036e13f28e5c6"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0c1b7bfde9ad3f995e6230c4f5e9309132773d49e0b4ab341c2871e10c5c393"}
{"level":"info","ts":"2026-07-13T07:50:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0106ec8bd33271f0631bb4e14ce8d7aa34536a7ad8750d46a6c3753e8f87e1e6"}
{"level":"info","ts":"2026-07-13T07:51:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9334047764ba3eca7e7a64a3aaf8cc728de78082b992c1849e61ac8a03fd11e4"}
{"level":"info","ts":"2026-07-13T07:51:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4bacf61c4c614c29d9059d9529b927cbaebe7ca1cd6f898d744ebcf27d946b45"}