--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) --- {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38dc4a3f-67bb-423a-be97-0f9a49a48e4d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38dc4a3f-67bb-423a-be97-0f9a49a48e4d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38dc4a3f-67bb-423a-be97-0f9a49a48e4d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af2c0637-7786-4180-8caf-e435684614f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35354","PortSpecifier":{"PortValue":35354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af2c0637-7786-4180-8caf-e435684614f0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af2c0637-7786-4180-8caf-e435684614f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35354","PortSpecifier":{"PortValue":35354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369488,"nanos":763384600},"http":{"id":"af2c0637-7786-4180-8caf-e435684614f0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"af2c0637-7786-4180-8caf-e435684614f0","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af2c0637-7786-4180-8caf-e435684614f0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"af2c0637-7786-4180-8caf-e435684614f0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"af2c0637-7786-4180-8caf-e435684614f0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":763384600,"seconds":1783369488},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35354","port":35354}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af2c0637-7786-4180-8caf-e435684614f0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af2c0637-7786-4180-8caf-e435684614f0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af2c0637-7786-4180-8caf-e435684614f0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35358","PortSpecifier":{"PortValue":35358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35358","PortSpecifier":{"PortValue":35358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369488,"nanos":812159915},"http":{"id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4762196a-4b0b-4d64-97ac-8f738eacfad7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":812159915,"seconds":1783369488},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35358","port":35358}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4762196a-4b0b-4d64-97ac-8f738eacfad7","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35366","PortSpecifier":{"PortValue":35366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35366","PortSpecifier":{"PortValue":35366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369488,"nanos":861802766},"http":{"id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":861802766,"seconds":1783369488},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35366","port":35366}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"35f0f2e4-6b58-4c53-81af-87a709de6f2f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35372","PortSpecifier":{"PortValue":35372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d11d7581-89f6-4b75-a44a-90a26d527141","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35372","PortSpecifier":{"PortValue":35372}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369488,"nanos":911985172},"http":{"id":"d11d7581-89f6-4b75-a44a-90a26d527141","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d11d7581-89f6-4b75-a44a-90a26d527141"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d11d7581-89f6-4b75-a44a-90a26d527141","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":911985172,"seconds":1783369488},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35372","port":35372}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d11d7581-89f6-4b75-a44a-90a26d527141","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35382","PortSpecifier":{"PortValue":35382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35382","PortSpecifier":{"PortValue":35382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369488,"nanos":962802826},"http":{"id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":962802826,"seconds":1783369488},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35382","port":35382}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61dbb0fe-74f3-45e3-a9db-45ad7dfd3c9e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35396","PortSpecifier":{"PortValue":35396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35396","PortSpecifier":{"PortValue":35396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":12484753},"http":{"id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":12484753,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35396","port":35396}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f45d16b-8cdc-4ae9-afef-fa33200d201d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35406","PortSpecifier":{"PortValue":35406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f031e3f2-3722-45ef-9c58-856cbcbead04","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35406","PortSpecifier":{"PortValue":35406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":62294086},"http":{"id":"f031e3f2-3722-45ef-9c58-856cbcbead04","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f031e3f2-3722-45ef-9c58-856cbcbead04"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f031e3f2-3722-45ef-9c58-856cbcbead04","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":62294086,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35406","port":35406}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f031e3f2-3722-45ef-9c58-856cbcbead04","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35418","PortSpecifier":{"PortValue":35418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35418","PortSpecifier":{"PortValue":35418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":112421822},"http":{"id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":112421822,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35418","port":35418}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f52c8064-70ea-41e2-a8a2-7264f2a95fe6","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35428","PortSpecifier":{"PortValue":35428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35428","PortSpecifier":{"PortValue":35428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":162365947},"http":{"id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"590bce6f-e39c-407f-aeff-9ef3ae189f82"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":162365947,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35428","port":35428}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"590bce6f-e39c-407f-aeff-9ef3ae189f82","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35442","PortSpecifier":{"PortValue":35442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35442","PortSpecifier":{"PortValue":35442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":213546153},"http":{"id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213546153,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35442","port":35442}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e829a974-6d38-4bfc-824d-8ed6f918c2b3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35454","PortSpecifier":{"PortValue":35454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d689cb28-3dee-468a-af4c-593c1f3589e9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35454","PortSpecifier":{"PortValue":35454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":262787214},"http":{"id":"d689cb28-3dee-468a-af4c-593c1f3589e9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d689cb28-3dee-468a-af4c-593c1f3589e9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d689cb28-3dee-468a-af4c-593c1f3589e9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":262787214,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35454","port":35454}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d689cb28-3dee-468a-af4c-593c1f3589e9","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35470","PortSpecifier":{"PortValue":35470}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f08e92b0-1953-4e11-bea9-f50860bae397","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35470","PortSpecifier":{"PortValue":35470}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":312345495},"http":{"id":"f08e92b0-1953-4e11-bea9-f50860bae397","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f08e92b0-1953-4e11-bea9-f50860bae397"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f08e92b0-1953-4e11-bea9-f50860bae397","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":312345495,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35470","port":35470}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f08e92b0-1953-4e11-bea9-f50860bae397","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35480","PortSpecifier":{"PortValue":35480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35480","PortSpecifier":{"PortValue":35480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":363138135},"http":{"id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":363138135,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35480","port":35480}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8abae07b-6159-4bee-9f9b-0e3108a0e15f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7463f40e-faa9-408a-b447-985caf023218","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35486","PortSpecifier":{"PortValue":35486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7463f40e-faa9-408a-b447-985caf023218","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7463f40e-faa9-408a-b447-985caf023218","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35486","PortSpecifier":{"PortValue":35486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":414214881},"http":{"id":"7463f40e-faa9-408a-b447-985caf023218","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7463f40e-faa9-408a-b447-985caf023218","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7463f40e-faa9-408a-b447-985caf023218","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7463f40e-faa9-408a-b447-985caf023218"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7463f40e-faa9-408a-b447-985caf023218","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":414214881,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35486","port":35486}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7463f40e-faa9-408a-b447-985caf023218","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7463f40e-faa9-408a-b447-985caf023218","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7463f40e-faa9-408a-b447-985caf023218","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35490","PortSpecifier":{"PortValue":35490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea56422c-25c0-459b-a1c4-a177739461fd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35490","PortSpecifier":{"PortValue":35490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":463571733},"http":{"id":"ea56422c-25c0-459b-a1c4-a177739461fd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ea56422c-25c0-459b-a1c4-a177739461fd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ea56422c-25c0-459b-a1c4-a177739461fd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":463571733,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35490","port":35490}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea56422c-25c0-459b-a1c4-a177739461fd","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f32afc40-21a7-478e-9f11-2d35df677842","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35496","PortSpecifier":{"PortValue":35496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f32afc40-21a7-478e-9f11-2d35df677842","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f32afc40-21a7-478e-9f11-2d35df677842","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35496","PortSpecifier":{"PortValue":35496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":512784783},"http":{"id":"f32afc40-21a7-478e-9f11-2d35df677842","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f32afc40-21a7-478e-9f11-2d35df677842","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f32afc40-21a7-478e-9f11-2d35df677842","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f32afc40-21a7-478e-9f11-2d35df677842"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f32afc40-21a7-478e-9f11-2d35df677842","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":512784783,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35496","port":35496}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f32afc40-21a7-478e-9f11-2d35df677842","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f32afc40-21a7-478e-9f11-2d35df677842","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f32afc40-21a7-478e-9f11-2d35df677842","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35500","PortSpecifier":{"PortValue":35500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35500","PortSpecifier":{"PortValue":35500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":561860637},"http":{"id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":561860637,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35500","port":35500}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4ce7fcd-b57e-4e8e-b905-a7fa45f8b0c0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35502","PortSpecifier":{"PortValue":35502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c519154e-07c6-4d25-b88e-1015fb6861b1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35502","PortSpecifier":{"PortValue":35502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":612499649},"http":{"id":"c519154e-07c6-4d25-b88e-1015fb6861b1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c519154e-07c6-4d25-b88e-1015fb6861b1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c519154e-07c6-4d25-b88e-1015fb6861b1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":612499649,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35502","port":35502}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c519154e-07c6-4d25-b88e-1015fb6861b1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35506","PortSpecifier":{"PortValue":35506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"446678e1-9cce-45ed-bc09-65f2a6cff546","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35506","PortSpecifier":{"PortValue":35506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":661205723},"http":{"id":"446678e1-9cce-45ed-bc09-65f2a6cff546","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"446678e1-9cce-45ed-bc09-65f2a6cff546"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"446678e1-9cce-45ed-bc09-65f2a6cff546","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":661205723,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35506","port":35506}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446678e1-9cce-45ed-bc09-65f2a6cff546","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35522","PortSpecifier":{"PortValue":35522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"948d2924-031f-4843-82c1-2e46c8d9a323","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35522","PortSpecifier":{"PortValue":35522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":712200451},"http":{"id":"948d2924-031f-4843-82c1-2e46c8d9a323","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"948d2924-031f-4843-82c1-2e46c8d9a323"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"948d2924-031f-4843-82c1-2e46c8d9a323","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":712200451,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35522","port":35522}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"948d2924-031f-4843-82c1-2e46c8d9a323","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35534","PortSpecifier":{"PortValue":35534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9c24e330-752c-4b9e-8d82-6cc53674103a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35534","PortSpecifier":{"PortValue":35534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":762486201},"http":{"id":"9c24e330-752c-4b9e-8d82-6cc53674103a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9c24e330-752c-4b9e-8d82-6cc53674103a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9c24e330-752c-4b9e-8d82-6cc53674103a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":762486201,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35534","port":35534}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c24e330-752c-4b9e-8d82-6cc53674103a","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35542","PortSpecifier":{"PortValue":35542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b96de699-bedf-4214-b0f5-efd1e4082d18","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35542","PortSpecifier":{"PortValue":35542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":811202485},"http":{"id":"b96de699-bedf-4214-b0f5-efd1e4082d18","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b96de699-bedf-4214-b0f5-efd1e4082d18"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b96de699-bedf-4214-b0f5-efd1e4082d18","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":811202485,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35542","port":35542}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b96de699-bedf-4214-b0f5-efd1e4082d18","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a533870-ec20-494c-954c-17222d210845","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35558","PortSpecifier":{"PortValue":35558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a533870-ec20-494c-954c-17222d210845","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a533870-ec20-494c-954c-17222d210845","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35558","PortSpecifier":{"PortValue":35558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":862753943},"http":{"id":"1a533870-ec20-494c-954c-17222d210845","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1a533870-ec20-494c-954c-17222d210845","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a533870-ec20-494c-954c-17222d210845","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1a533870-ec20-494c-954c-17222d210845"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1a533870-ec20-494c-954c-17222d210845","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":862753943,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35558","port":35558}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a533870-ec20-494c-954c-17222d210845","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a533870-ec20-494c-954c-17222d210845","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a533870-ec20-494c-954c-17222d210845","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35574","PortSpecifier":{"PortValue":35574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35574","PortSpecifier":{"PortValue":35574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":912053535},"http":{"id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f08818ef-17ef-4759-bff8-eeeca05b89eb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":912053535,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35574","port":35574}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f08818ef-17ef-4759-bff8-eeeca05b89eb","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20d49897-4832-48ef-a080-e5e2e679395f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35578","PortSpecifier":{"PortValue":35578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20d49897-4832-48ef-a080-e5e2e679395f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20d49897-4832-48ef-a080-e5e2e679395f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35578","PortSpecifier":{"PortValue":35578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369489,"nanos":961771749},"http":{"id":"20d49897-4832-48ef-a080-e5e2e679395f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"20d49897-4832-48ef-a080-e5e2e679395f","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20d49897-4832-48ef-a080-e5e2e679395f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"20d49897-4832-48ef-a080-e5e2e679395f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"20d49897-4832-48ef-a080-e5e2e679395f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":961771749,"seconds":1783369489},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35578","port":35578}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20d49897-4832-48ef-a080-e5e2e679395f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20d49897-4832-48ef-a080-e5e2e679395f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20d49897-4832-48ef-a080-e5e2e679395f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35582","PortSpecifier":{"PortValue":35582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35582","PortSpecifier":{"PortValue":35582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":11653363},"http":{"id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":11653363,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35582","port":35582}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9a1ab43-b05d-4dc2-ab78-3b817e536ce4","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35596","PortSpecifier":{"PortValue":35596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35596","PortSpecifier":{"PortValue":35596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":63071408},"http":{"id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":63071408,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35596","port":35596}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ebab9e2a-983a-4b26-8c3b-3111af1e69c8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35612","PortSpecifier":{"PortValue":35612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35612","PortSpecifier":{"PortValue":35612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":112937458},"http":{"id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":112937458,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35612","port":35612}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96c6aaaa-54ff-4ce5-9261-52fbe820319c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd726409-459d-4692-868d-b669e09a543b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35616","PortSpecifier":{"PortValue":35616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cd726409-459d-4692-868d-b669e09a543b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cd726409-459d-4692-868d-b669e09a543b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35616","PortSpecifier":{"PortValue":35616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":162603621},"http":{"id":"cd726409-459d-4692-868d-b669e09a543b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cd726409-459d-4692-868d-b669e09a543b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cd726409-459d-4692-868d-b669e09a543b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cd726409-459d-4692-868d-b669e09a543b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cd726409-459d-4692-868d-b669e09a543b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":162603621,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35616","port":35616}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cd726409-459d-4692-868d-b669e09a543b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd726409-459d-4692-868d-b669e09a543b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cd726409-459d-4692-868d-b669e09a543b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35624","PortSpecifier":{"PortValue":35624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35624","PortSpecifier":{"PortValue":35624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":211344902},"http":{"id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":211344902,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35624","port":35624}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"21ccd836-ceda-4f9e-b1c4-6d24f23f001d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35640","PortSpecifier":{"PortValue":35640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35640","PortSpecifier":{"PortValue":35640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":262111601},"http":{"id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":262111601,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35640","port":35640}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca66eae0-774e-49d9-b2bf-636cb4247ec4","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35642","PortSpecifier":{"PortValue":35642}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35642","PortSpecifier":{"PortValue":35642}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":311521829},"http":{"id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":311521829,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35642","port":35642}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac7fe5d-89ee-4f9e-95d5-6e275a662b21","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35654","PortSpecifier":{"PortValue":35654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35654","PortSpecifier":{"PortValue":35654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":362852124},"http":{"id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"086703c4-f3a9-4388-8a7f-bfadd26844a0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":362852124,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35654","port":35654}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"086703c4-f3a9-4388-8a7f-bfadd26844a0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35664","PortSpecifier":{"PortValue":35664}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35664","PortSpecifier":{"PortValue":35664}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":412874679},"http":{"id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":412874679,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35664","port":35664}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1a26599-e4a5-4673-acf0-4d92c5d82b63","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35676","PortSpecifier":{"PortValue":35676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"77f643c6-0ba7-421b-8dee-519ea107080c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35676","PortSpecifier":{"PortValue":35676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":461690311},"http":{"id":"77f643c6-0ba7-421b-8dee-519ea107080c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"77f643c6-0ba7-421b-8dee-519ea107080c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"77f643c6-0ba7-421b-8dee-519ea107080c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":461690311,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35676","port":35676}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77f643c6-0ba7-421b-8dee-519ea107080c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35686","PortSpecifier":{"PortValue":35686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35686","PortSpecifier":{"PortValue":35686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":512441397},"http":{"id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0903c0e0-746f-47e4-be3e-44ab71c308c6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":512441397,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35686","port":35686}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0903c0e0-746f-47e4-be3e-44ab71c308c6","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35696","PortSpecifier":{"PortValue":35696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8fbad359-ac74-43fa-97fa-6312c905c110","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35696","PortSpecifier":{"PortValue":35696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":561346507},"http":{"id":"8fbad359-ac74-43fa-97fa-6312c905c110","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8fbad359-ac74-43fa-97fa-6312c905c110"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8fbad359-ac74-43fa-97fa-6312c905c110","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":561346507,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35696","port":35696}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fbad359-ac74-43fa-97fa-6312c905c110","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35712","PortSpecifier":{"PortValue":35712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35712","PortSpecifier":{"PortValue":35712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":612865456},"http":{"id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":612865456,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35712","port":35712}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6925f3a7-13a3-41d7-847e-4fa0d29f23d1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35716","PortSpecifier":{"PortValue":35716}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35716","PortSpecifier":{"PortValue":35716}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":661522854},"http":{"id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7eb65ed7-410f-4701-bfe8-dec56b21863d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":661522854,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35716","port":35716}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eb65ed7-410f-4701-bfe8-dec56b21863d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35732","PortSpecifier":{"PortValue":35732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16c6a368-73a1-47f3-9ed4-81391879343e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35732","PortSpecifier":{"PortValue":35732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":712484299},"http":{"id":"16c6a368-73a1-47f3-9ed4-81391879343e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"16c6a368-73a1-47f3-9ed4-81391879343e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"16c6a368-73a1-47f3-9ed4-81391879343e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":712484299,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35732","port":35732}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16c6a368-73a1-47f3-9ed4-81391879343e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35738","PortSpecifier":{"PortValue":35738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69c7679b-9eb9-4489-9254-24c809bfb095","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35738","PortSpecifier":{"PortValue":35738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":762211579},"http":{"id":"69c7679b-9eb9-4489-9254-24c809bfb095","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"69c7679b-9eb9-4489-9254-24c809bfb095"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"69c7679b-9eb9-4489-9254-24c809bfb095","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":762211579,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35738","port":35738}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69c7679b-9eb9-4489-9254-24c809bfb095","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35742","PortSpecifier":{"PortValue":35742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35742","PortSpecifier":{"PortValue":35742}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":811866308},"http":{"id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":811866308,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35742","port":35742}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ef56c6d-1318-4ac0-be0b-75d73a92406c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35752","PortSpecifier":{"PortValue":35752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1202888-2b05-4352-8ec7-ecc98c638985","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35752","PortSpecifier":{"PortValue":35752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":861373853},"http":{"id":"a1202888-2b05-4352-8ec7-ecc98c638985","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a1202888-2b05-4352-8ec7-ecc98c638985"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a1202888-2b05-4352-8ec7-ecc98c638985","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":861373853,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35752","port":35752}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1202888-2b05-4352-8ec7-ecc98c638985","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35766","PortSpecifier":{"PortValue":35766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a43cc1a7-debb-4350-b608-fe105b4c9005","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35766","PortSpecifier":{"PortValue":35766}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":910793640},"http":{"id":"a43cc1a7-debb-4350-b608-fe105b4c9005","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a43cc1a7-debb-4350-b608-fe105b4c9005"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a43cc1a7-debb-4350-b608-fe105b4c9005","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":910793640,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35766","port":35766}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a43cc1a7-debb-4350-b608-fe105b4c9005","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35774","PortSpecifier":{"PortValue":35774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98f44643-6e21-4bdd-8474-c5d39175b3be","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35774","PortSpecifier":{"PortValue":35774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369490,"nanos":961421818},"http":{"id":"98f44643-6e21-4bdd-8474-c5d39175b3be","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"98f44643-6e21-4bdd-8474-c5d39175b3be"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"98f44643-6e21-4bdd-8474-c5d39175b3be","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":961421818,"seconds":1783369490},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35774","port":35774}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98f44643-6e21-4bdd-8474-c5d39175b3be","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35790","PortSpecifier":{"PortValue":35790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d3ee6312-2d96-4898-8909-b26518d490d5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35790","PortSpecifier":{"PortValue":35790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":11828185},"http":{"id":"d3ee6312-2d96-4898-8909-b26518d490d5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d3ee6312-2d96-4898-8909-b26518d490d5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d3ee6312-2d96-4898-8909-b26518d490d5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":11828185,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35790","port":35790}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3ee6312-2d96-4898-8909-b26518d490d5","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35796","PortSpecifier":{"PortValue":35796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"deebeb89-82ab-47b4-a615-b63c227f401a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35796","PortSpecifier":{"PortValue":35796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":61544886},"http":{"id":"deebeb89-82ab-47b4-a615-b63c227f401a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"deebeb89-82ab-47b4-a615-b63c227f401a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"deebeb89-82ab-47b4-a615-b63c227f401a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":61544886,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35796","port":35796}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"deebeb89-82ab-47b4-a615-b63c227f401a","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":111754017},"http":{"id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":111754017,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35800","port":35800}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f8851f1-bf38-4ba3-8a96-69cabaeb994c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35814","PortSpecifier":{"PortValue":35814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0de60e96-781c-4743-8942-ea9b76dc725f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35814","PortSpecifier":{"PortValue":35814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":161878832},"http":{"id":"0de60e96-781c-4743-8942-ea9b76dc725f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0de60e96-781c-4743-8942-ea9b76dc725f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0de60e96-781c-4743-8942-ea9b76dc725f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":161878832,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35814","port":35814}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0de60e96-781c-4743-8942-ea9b76dc725f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64802520-312f-40c1-92f6-d588f394413b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35816","PortSpecifier":{"PortValue":35816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"64802520-312f-40c1-92f6-d588f394413b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64802520-312f-40c1-92f6-d588f394413b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35816","PortSpecifier":{"PortValue":35816}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":211887352},"http":{"id":"64802520-312f-40c1-92f6-d588f394413b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"64802520-312f-40c1-92f6-d588f394413b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"64802520-312f-40c1-92f6-d588f394413b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"64802520-312f-40c1-92f6-d588f394413b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"64802520-312f-40c1-92f6-d588f394413b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":211887352,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35816","port":35816}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64802520-312f-40c1-92f6-d588f394413b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64802520-312f-40c1-92f6-d588f394413b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64802520-312f-40c1-92f6-d588f394413b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35828","PortSpecifier":{"PortValue":35828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35828","PortSpecifier":{"PortValue":35828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":261840199},"http":{"id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":261840199,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35828","port":35828}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b0dc0a0-2a82-41b2-9a8b-877c209b4129","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35836","PortSpecifier":{"PortValue":35836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35836","PortSpecifier":{"PortValue":35836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":311606646},"http":{"id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":311606646,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35836","port":35836}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"reason":"context canceled"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"reason":"context canceled"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"reason":"context canceled"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9554e2cf-63aa-4b75-b85f-2adb4b9f7ade","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35842","PortSpecifier":{"PortValue":35842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a61b58ae-de58-9c25-abd2-83c00970b03d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35842","PortSpecifier":{"PortValue":35842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":372379542},"http":{"id":"a61b58ae-de58-9c25-abd2-83c00970b03d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a61b58ae-de58-9c25-abd2-83c00970b03d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a61b58ae-de58-9c25-abd2-83c00970b03d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":372379542,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35842","port":35842}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a61b58ae-de58-9c25-abd2-83c00970b03d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35848","PortSpecifier":{"PortValue":35848}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35848","PortSpecifier":{"PortValue":35848}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":412213514},"http":{"id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":412213514,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35848","port":35848}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a1be4ac-93d6-4e44-a1ad-d74095efc469","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35862","PortSpecifier":{"PortValue":35862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35862","PortSpecifier":{"PortValue":35862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":461446208},"http":{"id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":461446208,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35862","port":35862}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5d8a991-7b87-4b26-b546-c0bfe4b39ec8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35878","PortSpecifier":{"PortValue":35878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35878","PortSpecifier":{"PortValue":35878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":511643583},"http":{"id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":511643583,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35878","port":35878}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce0cf212-9c1b-4918-86f8-cf22a09978ee","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35892","PortSpecifier":{"PortValue":35892}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35892","PortSpecifier":{"PortValue":35892}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":563027022},"http":{"id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e1ede88d-26f4-4f06-91ca-2901d400ef63"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":563027022,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35892","port":35892}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1ede88d-26f4-4f06-91ca-2901d400ef63","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35908","PortSpecifier":{"PortValue":35908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35908","PortSpecifier":{"PortValue":35908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":612175715},"http":{"id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a7ba4e51-1574-42e9-acff-e6ffae574a55"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":612175715,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35908","port":35908}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7ba4e51-1574-42e9-acff-e6ffae574a55","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f25cda2-29df-469b-8f0f-537669a78617","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35920","PortSpecifier":{"PortValue":35920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f25cda2-29df-469b-8f0f-537669a78617","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f25cda2-29df-469b-8f0f-537669a78617","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35920","PortSpecifier":{"PortValue":35920}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":663084684},"http":{"id":"5f25cda2-29df-469b-8f0f-537669a78617","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5f25cda2-29df-469b-8f0f-537669a78617","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f25cda2-29df-469b-8f0f-537669a78617","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5f25cda2-29df-469b-8f0f-537669a78617"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5f25cda2-29df-469b-8f0f-537669a78617","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":663084684,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35920","port":35920}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f25cda2-29df-469b-8f0f-537669a78617","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f25cda2-29df-469b-8f0f-537669a78617","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f25cda2-29df-469b-8f0f-537669a78617","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97a639bb-11cd-4533-98b2-583dda31d238","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35924","PortSpecifier":{"PortValue":35924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97a639bb-11cd-4533-98b2-583dda31d238","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97a639bb-11cd-4533-98b2-583dda31d238","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35924","PortSpecifier":{"PortValue":35924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":712121624},"http":{"id":"97a639bb-11cd-4533-98b2-583dda31d238","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"97a639bb-11cd-4533-98b2-583dda31d238","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97a639bb-11cd-4533-98b2-583dda31d238","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"97a639bb-11cd-4533-98b2-583dda31d238"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"97a639bb-11cd-4533-98b2-583dda31d238","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":712121624,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35924","port":35924}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97a639bb-11cd-4533-98b2-583dda31d238","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97a639bb-11cd-4533-98b2-583dda31d238","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97a639bb-11cd-4533-98b2-583dda31d238","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35938","PortSpecifier":{"PortValue":35938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35938","PortSpecifier":{"PortValue":35938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":763159435},"http":{"id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":763159435,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35938","port":35938}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c2e4b2e-49ac-4b5b-bed1-164b72f53c11","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35948","PortSpecifier":{"PortValue":35948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35948","PortSpecifier":{"PortValue":35948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":813259505},"http":{"id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":813259505,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35948","port":35948}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f19ff8bc-2857-45fb-9611-54d45a0d81f1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35958","PortSpecifier":{"PortValue":35958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35958","PortSpecifier":{"PortValue":35958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":862522223},"http":{"id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":862522223,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35958","port":35958}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f07332b3-54f3-40a3-a792-19bf5f5d2a9b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35970","PortSpecifier":{"PortValue":35970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"83642c5f-0183-4489-bf9c-46485f981d8e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35970","PortSpecifier":{"PortValue":35970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":912551679},"http":{"id":"83642c5f-0183-4489-bf9c-46485f981d8e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"83642c5f-0183-4489-bf9c-46485f981d8e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"83642c5f-0183-4489-bf9c-46485f981d8e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":912551679,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35970","port":35970}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83642c5f-0183-4489-bf9c-46485f981d8e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35982","PortSpecifier":{"PortValue":35982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35982","PortSpecifier":{"PortValue":35982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369491,"nanos":963023248},"http":{"id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":963023248,"seconds":1783369491},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35982","port":35982}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4989c60c-e7b5-4e8b-8f0c-354de44dfebe","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35996","PortSpecifier":{"PortValue":35996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"caef86bb-67eb-460d-9746-99bb800e8a97","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:35996","PortSpecifier":{"PortValue":35996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":12313252},"http":{"id":"caef86bb-67eb-460d-9746-99bb800e8a97","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"caef86bb-67eb-460d-9746-99bb800e8a97"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"caef86bb-67eb-460d-9746-99bb800e8a97","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":12313252,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:35996","port":35996}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caef86bb-67eb-460d-9746-99bb800e8a97","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36012","PortSpecifier":{"PortValue":36012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"139a5e90-7c49-49c5-b751-c7b359a29692","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36012","PortSpecifier":{"PortValue":36012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":63245906},"http":{"id":"139a5e90-7c49-49c5-b751-c7b359a29692","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"139a5e90-7c49-49c5-b751-c7b359a29692"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"139a5e90-7c49-49c5-b751-c7b359a29692","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":63245906,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36012","port":36012}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"139a5e90-7c49-49c5-b751-c7b359a29692","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36020","PortSpecifier":{"PortValue":36020}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36020","PortSpecifier":{"PortValue":36020}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":113875916},"http":{"id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":113875916,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36020","port":36020}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2c72e187-0f8a-46f9-9ef1-691ee0d70cd3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36024","PortSpecifier":{"PortValue":36024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36024","PortSpecifier":{"PortValue":36024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":163870408},"http":{"id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":163870408,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36024","port":36024}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e606fca8-18e3-4e8f-a3c1-e7c4114a170e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36038","PortSpecifier":{"PortValue":36038}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36038","PortSpecifier":{"PortValue":36038}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":214563235},"http":{"id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":214563235,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36038","port":36038}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bd3a44d2-4b9b-4f33-9879-e4607ac05ec0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36040","PortSpecifier":{"PortValue":36040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36040","PortSpecifier":{"PortValue":36040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":262783574},"http":{"id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":262783574,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36040","port":36040}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e1bd859-64df-4c4d-b704-8781a2f6ab40","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78930508-772b-428a-8bb5-aae324e6fb87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36042","PortSpecifier":{"PortValue":36042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78930508-772b-428a-8bb5-aae324e6fb87","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78930508-772b-428a-8bb5-aae324e6fb87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36042","PortSpecifier":{"PortValue":36042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":312952195},"http":{"id":"78930508-772b-428a-8bb5-aae324e6fb87","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"78930508-772b-428a-8bb5-aae324e6fb87","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78930508-772b-428a-8bb5-aae324e6fb87","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"78930508-772b-428a-8bb5-aae324e6fb87"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"78930508-772b-428a-8bb5-aae324e6fb87","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":312952195,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36042","port":36042}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"78930508-772b-428a-8bb5-aae324e6fb87","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78930508-772b-428a-8bb5-aae324e6fb87","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78930508-772b-428a-8bb5-aae324e6fb87","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36048","PortSpecifier":{"PortValue":36048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36048","PortSpecifier":{"PortValue":36048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":362388023},"http":{"id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":362388023,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36048","port":36048}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeea9a75-ebdd-42e5-b1c1-788cd0d12cf7","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96ea3549-3215-44b7-b470-be979209ed69","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36050","PortSpecifier":{"PortValue":36050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96ea3549-3215-44b7-b470-be979209ed69","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96ea3549-3215-44b7-b470-be979209ed69","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36050","PortSpecifier":{"PortValue":36050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":413365522},"http":{"id":"96ea3549-3215-44b7-b470-be979209ed69","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"96ea3549-3215-44b7-b470-be979209ed69","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96ea3549-3215-44b7-b470-be979209ed69","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"96ea3549-3215-44b7-b470-be979209ed69"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"96ea3549-3215-44b7-b470-be979209ed69","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":413365522,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36050","port":36050}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96ea3549-3215-44b7-b470-be979209ed69","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96ea3549-3215-44b7-b470-be979209ed69","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96ea3549-3215-44b7-b470-be979209ed69","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36058","PortSpecifier":{"PortValue":36058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"001e6e08-8206-4368-832f-5054f7d7c6f7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36058","PortSpecifier":{"PortValue":36058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":463654746},"http":{"id":"001e6e08-8206-4368-832f-5054f7d7c6f7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"001e6e08-8206-4368-832f-5054f7d7c6f7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"001e6e08-8206-4368-832f-5054f7d7c6f7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":463654746,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36058","port":36058}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"001e6e08-8206-4368-832f-5054f7d7c6f7","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36062","PortSpecifier":{"PortValue":36062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36062","PortSpecifier":{"PortValue":36062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":513271896},"http":{"id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":513271896,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36062","port":36062}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a37ce4d-ad68-4439-8f4c-29ecb9ed2d4b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5fc2753a-0144-4244-aed8-176b461185fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36068","PortSpecifier":{"PortValue":36068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5fc2753a-0144-4244-aed8-176b461185fd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5fc2753a-0144-4244-aed8-176b461185fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36068","PortSpecifier":{"PortValue":36068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":563025430},"http":{"id":"5fc2753a-0144-4244-aed8-176b461185fd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5fc2753a-0144-4244-aed8-176b461185fd","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5fc2753a-0144-4244-aed8-176b461185fd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5fc2753a-0144-4244-aed8-176b461185fd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5fc2753a-0144-4244-aed8-176b461185fd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":563025430,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36068","port":36068}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fc2753a-0144-4244-aed8-176b461185fd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5fc2753a-0144-4244-aed8-176b461185fd","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5fc2753a-0144-4244-aed8-176b461185fd","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fab10d36-843a-43b6-888b-ae6823074460","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36076","PortSpecifier":{"PortValue":36076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fab10d36-843a-43b6-888b-ae6823074460","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fab10d36-843a-43b6-888b-ae6823074460","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36076","PortSpecifier":{"PortValue":36076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":612782058},"http":{"id":"fab10d36-843a-43b6-888b-ae6823074460","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fab10d36-843a-43b6-888b-ae6823074460","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fab10d36-843a-43b6-888b-ae6823074460","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fab10d36-843a-43b6-888b-ae6823074460"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fab10d36-843a-43b6-888b-ae6823074460","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":612782058,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36076","port":36076}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fab10d36-843a-43b6-888b-ae6823074460","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fab10d36-843a-43b6-888b-ae6823074460","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fab10d36-843a-43b6-888b-ae6823074460","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e875814-6db4-4a23-ab98-b1390970531d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36084","PortSpecifier":{"PortValue":36084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2e875814-6db4-4a23-ab98-b1390970531d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e875814-6db4-4a23-ab98-b1390970531d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36084","PortSpecifier":{"PortValue":36084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":663084093},"http":{"id":"2e875814-6db4-4a23-ab98-b1390970531d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2e875814-6db4-4a23-ab98-b1390970531d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2e875814-6db4-4a23-ab98-b1390970531d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2e875814-6db4-4a23-ab98-b1390970531d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2e875814-6db4-4a23-ab98-b1390970531d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":663084093,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36084","port":36084}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e875814-6db4-4a23-ab98-b1390970531d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e875814-6db4-4a23-ab98-b1390970531d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e875814-6db4-4a23-ab98-b1390970531d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36088","PortSpecifier":{"PortValue":36088}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36088","PortSpecifier":{"PortValue":36088}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":714008020},"http":{"id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":714008020,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36088","port":36088}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e81b4b6-3c47-404e-a9af-ddb1f3233da3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36090","PortSpecifier":{"PortValue":36090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36090","PortSpecifier":{"PortValue":36090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":763336893},"http":{"id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":763336893,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36090","port":36090}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e273ef-982d-4411-b9d8-c9e4534f97b8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36096","PortSpecifier":{"PortValue":36096}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36096","PortSpecifier":{"PortValue":36096}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":813039533},"http":{"id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":813039533,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36096","port":36096}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d2262ce-925a-4a6a-9ec9-5efedd70229d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36104","PortSpecifier":{"PortValue":36104}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36104","PortSpecifier":{"PortValue":36104}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":863213977},"http":{"id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e86355ee-90d4-4e8e-ba42-369bf020a21f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":863213977,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36104","port":36104}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e86355ee-90d4-4e8e-ba42-369bf020a21f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36116","PortSpecifier":{"PortValue":36116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36116","PortSpecifier":{"PortValue":36116}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":912684050},"http":{"id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":912684050,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36116","port":36116}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"069abd3c-0f60-450a-b1ae-3ddd546b14cc","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36122","PortSpecifier":{"PortValue":36122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36122","PortSpecifier":{"PortValue":36122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369492,"nanos":963108481},"http":{"id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":963108481,"seconds":1783369492},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36122","port":36122}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"19064f6a-66fa-40a1-bd3e-a52027b72ef3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36134","PortSpecifier":{"PortValue":36134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36134","PortSpecifier":{"PortValue":36134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":13482196},"http":{"id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":13482196,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36134","port":36134}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5def0d04-dc88-492e-8dea-0bcab3df7fe5","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36140","PortSpecifier":{"PortValue":36140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36140","PortSpecifier":{"PortValue":36140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":63756727},"http":{"id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":63756727,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36140","port":36140}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43f39f18-c1ac-47b3-9b33-f3e73d63425b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36144","PortSpecifier":{"PortValue":36144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cbf9c34-581e-4925-809c-aca94ca303d2","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36144","PortSpecifier":{"PortValue":36144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":114070269},"http":{"id":"0cbf9c34-581e-4925-809c-aca94ca303d2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0cbf9c34-581e-4925-809c-aca94ca303d2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0cbf9c34-581e-4925-809c-aca94ca303d2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":114070269,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36144","port":36144}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cbf9c34-581e-4925-809c-aca94ca303d2","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36150","PortSpecifier":{"PortValue":36150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"83cfd501-914d-439e-89bf-454be9cdd0a4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36150","PortSpecifier":{"PortValue":36150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":162537888},"http":{"id":"83cfd501-914d-439e-89bf-454be9cdd0a4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"83cfd501-914d-439e-89bf-454be9cdd0a4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"83cfd501-914d-439e-89bf-454be9cdd0a4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":162537888,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36150","port":36150}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83cfd501-914d-439e-89bf-454be9cdd0a4","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36166","PortSpecifier":{"PortValue":36166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36166","PortSpecifier":{"PortValue":36166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":213994023},"http":{"id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213994023,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36166","port":36166}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a940a2ff-c6cb-4551-8a7c-0da37360ee03","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36182","PortSpecifier":{"PortValue":36182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"67d3b83e-0e28-46da-a343-470d6a3b4281","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36182","PortSpecifier":{"PortValue":36182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":263147932},"http":{"id":"67d3b83e-0e28-46da-a343-470d6a3b4281","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"67d3b83e-0e28-46da-a343-470d6a3b4281"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"67d3b83e-0e28-46da-a343-470d6a3b4281","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":263147932,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36182","port":36182}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67d3b83e-0e28-46da-a343-470d6a3b4281","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36198","PortSpecifier":{"PortValue":36198}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"604a178c-9d51-4178-8923-7aa09b60b5fc","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36198","PortSpecifier":{"PortValue":36198}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":313583925},"http":{"id":"604a178c-9d51-4178-8923-7aa09b60b5fc","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"604a178c-9d51-4178-8923-7aa09b60b5fc"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"604a178c-9d51-4178-8923-7aa09b60b5fc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":313583925,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36198","port":36198}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"604a178c-9d51-4178-8923-7aa09b60b5fc","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36210","PortSpecifier":{"PortValue":36210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36210","PortSpecifier":{"PortValue":36210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":363559921},"http":{"id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":363559921,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36210","port":36210}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8418d9bc-41d3-4f5e-a33a-3a914cc7d7ec","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36214","PortSpecifier":{"PortValue":36214}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36214","PortSpecifier":{"PortValue":36214}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":413126684},"http":{"id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":413126684,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36214","port":36214}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48b3eca2-ce51-4f3e-91ac-3e4b4e826bd8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5052c551-201c-4210-9697-248b3a6db5e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36230","PortSpecifier":{"PortValue":36230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5052c551-201c-4210-9697-248b3a6db5e3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5052c551-201c-4210-9697-248b3a6db5e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36230","PortSpecifier":{"PortValue":36230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":466098105},"http":{"id":"5052c551-201c-4210-9697-248b3a6db5e3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5052c551-201c-4210-9697-248b3a6db5e3","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5052c551-201c-4210-9697-248b3a6db5e3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5052c551-201c-4210-9697-248b3a6db5e3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5052c551-201c-4210-9697-248b3a6db5e3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":466098105,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36230","port":36230}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5052c551-201c-4210-9697-248b3a6db5e3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5052c551-201c-4210-9697-248b3a6db5e3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5052c551-201c-4210-9697-248b3a6db5e3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36244","PortSpecifier":{"PortValue":36244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36244","PortSpecifier":{"PortValue":36244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":513061020},"http":{"id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bcec4d48-313d-4fd5-b675-add0a9a8473a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":513061020,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36244","port":36244}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bcec4d48-313d-4fd5-b675-add0a9a8473a","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10e47379-0efe-43ff-95f9-819e718a098d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36254","PortSpecifier":{"PortValue":36254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"10e47379-0efe-43ff-95f9-819e718a098d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10e47379-0efe-43ff-95f9-819e718a098d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36254","PortSpecifier":{"PortValue":36254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":562934448},"http":{"id":"10e47379-0efe-43ff-95f9-819e718a098d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"10e47379-0efe-43ff-95f9-819e718a098d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"10e47379-0efe-43ff-95f9-819e718a098d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"10e47379-0efe-43ff-95f9-819e718a098d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"10e47379-0efe-43ff-95f9-819e718a098d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":562934448,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36254","port":36254}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10e47379-0efe-43ff-95f9-819e718a098d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10e47379-0efe-43ff-95f9-819e718a098d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10e47379-0efe-43ff-95f9-819e718a098d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36260","PortSpecifier":{"PortValue":36260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71312011-0ef6-44b3-92c4-d939acf37c49","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36260","PortSpecifier":{"PortValue":36260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":614634916},"http":{"id":"71312011-0ef6-44b3-92c4-d939acf37c49","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"71312011-0ef6-44b3-92c4-d939acf37c49"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"71312011-0ef6-44b3-92c4-d939acf37c49","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":614634916,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36260","port":36260}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71312011-0ef6-44b3-92c4-d939acf37c49","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36264","PortSpecifier":{"PortValue":36264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36264","PortSpecifier":{"PortValue":36264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":663573972},"http":{"id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ed3971e4-5252-4d1f-9a1e-352da37f6485"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":663573972,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36264","port":36264}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ed3971e4-5252-4d1f-9a1e-352da37f6485","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36278","PortSpecifier":{"PortValue":36278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36278","PortSpecifier":{"PortValue":36278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":713999807},"http":{"id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":713999807,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36278","port":36278}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36294","PortSpecifier":{"PortValue":36294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"15be613f-c5cc-4982-91a0-40f7106237c5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36294","PortSpecifier":{"PortValue":36294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":767107688},"http":{"id":"15be613f-c5cc-4982-91a0-40f7106237c5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"15be613f-c5cc-4982-91a0-40f7106237c5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"15be613f-c5cc-4982-91a0-40f7106237c5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":767107688,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36294","port":36294}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36304","PortSpecifier":{"PortValue":36304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36304","PortSpecifier":{"PortValue":36304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":842197838},"http":{"id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":842197838,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36304","port":36304}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36314","PortSpecifier":{"PortValue":36314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8775ff68-ef86-485b-b912-ef95e09564f7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36314","PortSpecifier":{"PortValue":36314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":936235327},"http":{"id":"8775ff68-ef86-485b-b912-ef95e09564f7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8775ff68-ef86-485b-b912-ef95e09564f7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8775ff68-ef86-485b-b912-ef95e09564f7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":936235327,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36314","port":36314}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36324","PortSpecifier":{"PortValue":36324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36324","PortSpecifier":{"PortValue":36324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":957038719},"http":{"id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":957038719,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36324","port":36324}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36326","PortSpecifier":{"PortValue":36326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36326","PortSpecifier":{"PortValue":36326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":977560702},"http":{"id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":977560702,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36326","port":36326}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36336","PortSpecifier":{"PortValue":36336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36336","PortSpecifier":{"PortValue":36336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":13604176},"http":{"id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":13604176,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36336","port":36336}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36338","PortSpecifier":{"PortValue":36338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36338","PortSpecifier":{"PortValue":36338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":63599883},"http":{"id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":63599883,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36338","port":36338}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36352","PortSpecifier":{"PortValue":36352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36352","PortSpecifier":{"PortValue":36352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":113221592},"http":{"id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f6579e1c-45b8-46be-a25f-122cd30ad2be"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":113221592,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36352","port":36352}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36364","PortSpecifier":{"PortValue":36364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9fc816ef-cf72-4330-a7bb-7143836d318c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36364","PortSpecifier":{"PortValue":36364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":164160567},"http":{"id":"9fc816ef-cf72-4330-a7bb-7143836d318c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9fc816ef-cf72-4330-a7bb-7143836d318c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9fc816ef-cf72-4330-a7bb-7143836d318c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":164160567,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36364","port":36364}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36368","PortSpecifier":{"PortValue":36368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36368","PortSpecifier":{"PortValue":36368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":213830180},"http":{"id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213830180,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36368","port":36368}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36374","PortSpecifier":{"PortValue":36374}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36374","PortSpecifier":{"PortValue":36374}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":263789570},"http":{"id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"08968885-aea9-4e4c-a3c9-925f4662f8b3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":263789570,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36374","port":36374}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36378","PortSpecifier":{"PortValue":36378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36378","PortSpecifier":{"PortValue":36378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":313651845},"http":{"id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":313651845,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36378","port":36378}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"192845dd-2774-401e-8164-d9735053608e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36392","PortSpecifier":{"PortValue":36392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"192845dd-2774-401e-8164-d9735053608e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"192845dd-2774-401e-8164-d9735053608e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36392","PortSpecifier":{"PortValue":36392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":362841791},"http":{"id":"192845dd-2774-401e-8164-d9735053608e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"192845dd-2774-401e-8164-d9735053608e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"192845dd-2774-401e-8164-d9735053608e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"192845dd-2774-401e-8164-d9735053608e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"192845dd-2774-401e-8164-d9735053608e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":362841791,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36392","port":36392}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"192845dd-2774-401e-8164-d9735053608e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"192845dd-2774-401e-8164-d9735053608e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36398","PortSpecifier":{"PortValue":36398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36398","PortSpecifier":{"PortValue":36398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":414145640},"http":{"id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":414145640,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36398","port":36398}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36408","PortSpecifier":{"PortValue":36408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36408","PortSpecifier":{"PortValue":36408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":463320762},"http":{"id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":463320762,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36408","port":36408}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36422","PortSpecifier":{"PortValue":36422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36422","PortSpecifier":{"PortValue":36422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":514285958},"http":{"id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":514285958,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36422","port":36422}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36434","PortSpecifier":{"PortValue":36434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8fe9dae6-7675-4627-a123-0a7aedc721af","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36434","PortSpecifier":{"PortValue":36434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":563653014},"http":{"id":"8fe9dae6-7675-4627-a123-0a7aedc721af","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8fe9dae6-7675-4627-a123-0a7aedc721af"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8fe9dae6-7675-4627-a123-0a7aedc721af","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":563653014,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36434","port":36434}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36438","PortSpecifier":{"PortValue":36438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36438","PortSpecifier":{"PortValue":36438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":613437757},"http":{"id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"be7b5ad1-fe31-4dea-bda3-e04e04140183"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":613437757,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36438","port":36438}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36450","PortSpecifier":{"PortValue":36450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36450","PortSpecifier":{"PortValue":36450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":663331576},"http":{"id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":663331576,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36450","port":36450}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36460","PortSpecifier":{"PortValue":36460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5891fe8f-2987-4a97-afcb-31b651d84d27","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36460","PortSpecifier":{"PortValue":36460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":713260862},"http":{"id":"5891fe8f-2987-4a97-afcb-31b651d84d27","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5891fe8f-2987-4a97-afcb-31b651d84d27"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5891fe8f-2987-4a97-afcb-31b651d84d27","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":713260862,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36460","port":36460}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36466","PortSpecifier":{"PortValue":36466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36466","PortSpecifier":{"PortValue":36466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":763702512},"http":{"id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":763702512,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36466","port":36466}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"213fcfc6-2116-913c-8790-51b261363f28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36478","PortSpecifier":{"PortValue":36478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"213fcfc6-2116-913c-8790-51b261363f28","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"213fcfc6-2116-913c-8790-51b261363f28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36478","PortSpecifier":{"PortValue":36478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":813294636},"http":{"id":"213fcfc6-2116-913c-8790-51b261363f28","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"213fcfc6-2116-913c-8790-51b261363f28","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"213fcfc6-2116-913c-8790-51b261363f28","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"213fcfc6-2116-913c-8790-51b261363f28"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"213fcfc6-2116-913c-8790-51b261363f28","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":813294636,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36478","port":36478}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"213fcfc6-2116-913c-8790-51b261363f28","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"213fcfc6-2116-913c-8790-51b261363f28","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2024eb90-8554-40bc-8332-66c907e8087e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36484","PortSpecifier":{"PortValue":36484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2024eb90-8554-40bc-8332-66c907e8087e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2024eb90-8554-40bc-8332-66c907e8087e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36484","PortSpecifier":{"PortValue":36484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":864504393},"http":{"id":"2024eb90-8554-40bc-8332-66c907e8087e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2024eb90-8554-40bc-8332-66c907e8087e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2024eb90-8554-40bc-8332-66c907e8087e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2024eb90-8554-40bc-8332-66c907e8087e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2024eb90-8554-40bc-8332-66c907e8087e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":864504393,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36484","port":36484}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2024eb90-8554-40bc-8332-66c907e8087e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2024eb90-8554-40bc-8332-66c907e8087e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36498","PortSpecifier":{"PortValue":36498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6b99f635-6738-4018-84b2-0dc5ff61db53","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36498","PortSpecifier":{"PortValue":36498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":913373558},"http":{"id":"6b99f635-6738-4018-84b2-0dc5ff61db53","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6b99f635-6738-4018-84b2-0dc5ff61db53"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6b99f635-6738-4018-84b2-0dc5ff61db53","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":913373558,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36498","port":36498}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36506","PortSpecifier":{"PortValue":36506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36506","PortSpecifier":{"PortValue":36506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":963751234},"http":{"id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":963751234,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36506","port":36506}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36510","PortSpecifier":{"PortValue":36510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c110686-738b-49c1-8c24-7b73a88276ee","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36510","PortSpecifier":{"PortValue":36510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":13490593},"http":{"id":"5c110686-738b-49c1-8c24-7b73a88276ee","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5c110686-738b-49c1-8c24-7b73a88276ee"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5c110686-738b-49c1-8c24-7b73a88276ee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":13490593,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36510","port":36510}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36518","PortSpecifier":{"PortValue":36518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9052056e-dc13-40dd-bf52-066bd56c1387","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36518","PortSpecifier":{"PortValue":36518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":63804588},"http":{"id":"9052056e-dc13-40dd-bf52-066bd56c1387","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9052056e-dc13-40dd-bf52-066bd56c1387"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9052056e-dc13-40dd-bf52-066bd56c1387","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":63804588,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36518","port":36518}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36522","PortSpecifier":{"PortValue":36522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b03ad80-61dc-4025-90cf-f92ec106120a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36522","PortSpecifier":{"PortValue":36522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":112704061},"http":{"id":"3b03ad80-61dc-4025-90cf-f92ec106120a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3b03ad80-61dc-4025-90cf-f92ec106120a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3b03ad80-61dc-4025-90cf-f92ec106120a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":112704061,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36522","port":36522}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36534","PortSpecifier":{"PortValue":36534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36534","PortSpecifier":{"PortValue":36534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":163402598},"http":{"id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":163402598,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36534","port":36534}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36544","PortSpecifier":{"PortValue":36544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36544","PortSpecifier":{"PortValue":36544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":213395493},"http":{"id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213395493,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36544","port":36544}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36560","PortSpecifier":{"PortValue":36560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36560","PortSpecifier":{"PortValue":36560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":262953947},"http":{"id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3d319f26-cce7-46e3-b841-5cb47fbc0926"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":262953947,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36560","port":36560}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36572","PortSpecifier":{"PortValue":36572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36572","PortSpecifier":{"PortValue":36572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":312643855},"http":{"id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"92b166a6-dc8e-4de3-86e1-742f682b4d27"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":312643855,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36572","port":36572}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36584","PortSpecifier":{"PortValue":36584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36584","PortSpecifier":{"PortValue":36584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":363441608},"http":{"id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":363441608,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36584","port":36584}}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","authorized":true,"response":"OK"}