{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1e289e5-2a4a-4d27-b134-c714c51dff4f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36294","PortSpecifier":{"PortValue":36294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"15be613f-c5cc-4982-91a0-40f7106237c5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36294","PortSpecifier":{"PortValue":36294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":767107688},"http":{"id":"15be613f-c5cc-4982-91a0-40f7106237c5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"15be613f-c5cc-4982-91a0-40f7106237c5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"15be613f-c5cc-4982-91a0-40f7106237c5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":767107688,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36294","port":36294}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15be613f-c5cc-4982-91a0-40f7106237c5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36304","PortSpecifier":{"PortValue":36304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36304","PortSpecifier":{"PortValue":36304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":842197838},"http":{"id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":842197838,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36304","port":36304}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac36074-9fe4-9ab9-9337-20bcd94bdb57","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36314","PortSpecifier":{"PortValue":36314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8775ff68-ef86-485b-b912-ef95e09564f7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36314","PortSpecifier":{"PortValue":36314}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":936235327},"http":{"id":"8775ff68-ef86-485b-b912-ef95e09564f7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8775ff68-ef86-485b-b912-ef95e09564f7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8775ff68-ef86-485b-b912-ef95e09564f7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":936235327,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36314","port":36314}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8775ff68-ef86-485b-b912-ef95e09564f7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36324","PortSpecifier":{"PortValue":36324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36324","PortSpecifier":{"PortValue":36324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":957038719},"http":{"id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":957038719,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36324","port":36324}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8128aba4-e90e-4dc5-90f6-c68fdbcf9bf8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36326","PortSpecifier":{"PortValue":36326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36326","PortSpecifier":{"PortValue":36326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369493,"nanos":977560702},"http":{"id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":977560702,"seconds":1783369493},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36326","port":36326}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"295eb89b-8a1f-41e9-becc-2a85cb2c3305","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36336","PortSpecifier":{"PortValue":36336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36336","PortSpecifier":{"PortValue":36336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":13604176},"http":{"id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":13604176,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36336","port":36336}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16d1ae0d-1202-4639-9eac-a75e9fe5d3b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36338","PortSpecifier":{"PortValue":36338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36338","PortSpecifier":{"PortValue":36338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":63599883},"http":{"id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":63599883,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36338","port":36338}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bcde98a-aec3-44d6-9ad7-45b76671ceb5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36352","PortSpecifier":{"PortValue":36352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36352","PortSpecifier":{"PortValue":36352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":113221592},"http":{"id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f6579e1c-45b8-46be-a25f-122cd30ad2be"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":113221592,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36352","port":36352}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6579e1c-45b8-46be-a25f-122cd30ad2be","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36364","PortSpecifier":{"PortValue":36364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9fc816ef-cf72-4330-a7bb-7143836d318c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36364","PortSpecifier":{"PortValue":36364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":164160567},"http":{"id":"9fc816ef-cf72-4330-a7bb-7143836d318c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9fc816ef-cf72-4330-a7bb-7143836d318c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9fc816ef-cf72-4330-a7bb-7143836d318c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":164160567,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36364","port":36364}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fc816ef-cf72-4330-a7bb-7143836d318c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36368","PortSpecifier":{"PortValue":36368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36368","PortSpecifier":{"PortValue":36368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":213830180},"http":{"id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213830180,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36368","port":36368}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ed18aad-646e-4aca-8b65-a5307c8d4acf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36374","PortSpecifier":{"PortValue":36374}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36374","PortSpecifier":{"PortValue":36374}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":263789570},"http":{"id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"08968885-aea9-4e4c-a3c9-925f4662f8b3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":263789570,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36374","port":36374}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08968885-aea9-4e4c-a3c9-925f4662f8b3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36378","PortSpecifier":{"PortValue":36378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36378","PortSpecifier":{"PortValue":36378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":313651845},"http":{"id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":313651845,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36378","port":36378}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"448cafc7-84b4-45bf-8b65-ba0ee54e1a02","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"192845dd-2774-401e-8164-d9735053608e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36392","PortSpecifier":{"PortValue":36392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"192845dd-2774-401e-8164-d9735053608e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"192845dd-2774-401e-8164-d9735053608e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36392","PortSpecifier":{"PortValue":36392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":362841791},"http":{"id":"192845dd-2774-401e-8164-d9735053608e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"192845dd-2774-401e-8164-d9735053608e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"192845dd-2774-401e-8164-d9735053608e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"192845dd-2774-401e-8164-d9735053608e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"192845dd-2774-401e-8164-d9735053608e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":362841791,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36392","port":36392}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"192845dd-2774-401e-8164-d9735053608e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"192845dd-2774-401e-8164-d9735053608e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"192845dd-2774-401e-8164-d9735053608e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36398","PortSpecifier":{"PortValue":36398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36398","PortSpecifier":{"PortValue":36398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":414145640},"http":{"id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":414145640,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36398","port":36398}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ff7b14d-ec61-4698-9c1f-2274c35aa16b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36408","PortSpecifier":{"PortValue":36408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36408","PortSpecifier":{"PortValue":36408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":463320762},"http":{"id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":463320762,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36408","port":36408}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12172f5d-3532-4f01-99cf-b1dcf11cbdaa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36422","PortSpecifier":{"PortValue":36422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36422","PortSpecifier":{"PortValue":36422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":514285958},"http":{"id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":514285958,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36422","port":36422}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac55fa85-97ba-4ad2-bd2f-01a4259aef16","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36434","PortSpecifier":{"PortValue":36434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8fe9dae6-7675-4627-a123-0a7aedc721af","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36434","PortSpecifier":{"PortValue":36434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":563653014},"http":{"id":"8fe9dae6-7675-4627-a123-0a7aedc721af","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8fe9dae6-7675-4627-a123-0a7aedc721af"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8fe9dae6-7675-4627-a123-0a7aedc721af","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":563653014,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36434","port":36434}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fe9dae6-7675-4627-a123-0a7aedc721af","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36438","PortSpecifier":{"PortValue":36438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36438","PortSpecifier":{"PortValue":36438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":613437757},"http":{"id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"be7b5ad1-fe31-4dea-bda3-e04e04140183"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":613437757,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36438","port":36438}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be7b5ad1-fe31-4dea-bda3-e04e04140183","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36450","PortSpecifier":{"PortValue":36450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36450","PortSpecifier":{"PortValue":36450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":663331576},"http":{"id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":663331576,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36450","port":36450}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba86406b-fdbe-40cb-9fd8-977b8147c9e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36460","PortSpecifier":{"PortValue":36460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5891fe8f-2987-4a97-afcb-31b651d84d27","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36460","PortSpecifier":{"PortValue":36460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":713260862},"http":{"id":"5891fe8f-2987-4a97-afcb-31b651d84d27","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5891fe8f-2987-4a97-afcb-31b651d84d27"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5891fe8f-2987-4a97-afcb-31b651d84d27","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":713260862,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36460","port":36460}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5891fe8f-2987-4a97-afcb-31b651d84d27","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36466","PortSpecifier":{"PortValue":36466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36466","PortSpecifier":{"PortValue":36466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":763702512},"http":{"id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":763702512,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36466","port":36466}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ebfeb49-923d-4a3e-bab4-f5ecd66b3692","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"213fcfc6-2116-913c-8790-51b261363f28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36478","PortSpecifier":{"PortValue":36478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"213fcfc6-2116-913c-8790-51b261363f28","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"213fcfc6-2116-913c-8790-51b261363f28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36478","PortSpecifier":{"PortValue":36478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":813294636},"http":{"id":"213fcfc6-2116-913c-8790-51b261363f28","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"213fcfc6-2116-913c-8790-51b261363f28","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"213fcfc6-2116-913c-8790-51b261363f28","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"213fcfc6-2116-913c-8790-51b261363f28"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"213fcfc6-2116-913c-8790-51b261363f28","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":813294636,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36478","port":36478}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213fcfc6-2116-913c-8790-51b261363f28","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"213fcfc6-2116-913c-8790-51b261363f28","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"213fcfc6-2116-913c-8790-51b261363f28","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2024eb90-8554-40bc-8332-66c907e8087e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36484","PortSpecifier":{"PortValue":36484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2024eb90-8554-40bc-8332-66c907e8087e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2024eb90-8554-40bc-8332-66c907e8087e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36484","PortSpecifier":{"PortValue":36484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":864504393},"http":{"id":"2024eb90-8554-40bc-8332-66c907e8087e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2024eb90-8554-40bc-8332-66c907e8087e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2024eb90-8554-40bc-8332-66c907e8087e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2024eb90-8554-40bc-8332-66c907e8087e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2024eb90-8554-40bc-8332-66c907e8087e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":864504393,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36484","port":36484}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2024eb90-8554-40bc-8332-66c907e8087e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2024eb90-8554-40bc-8332-66c907e8087e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2024eb90-8554-40bc-8332-66c907e8087e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36498","PortSpecifier":{"PortValue":36498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6b99f635-6738-4018-84b2-0dc5ff61db53","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36498","PortSpecifier":{"PortValue":36498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":913373558},"http":{"id":"6b99f635-6738-4018-84b2-0dc5ff61db53","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6b99f635-6738-4018-84b2-0dc5ff61db53"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6b99f635-6738-4018-84b2-0dc5ff61db53","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":913373558,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36498","port":36498}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b99f635-6738-4018-84b2-0dc5ff61db53","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36506","PortSpecifier":{"PortValue":36506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36506","PortSpecifier":{"PortValue":36506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369494,"nanos":963751234},"http":{"id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":963751234,"seconds":1783369494},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36506","port":36506}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ba7a6f7-58ef-4591-a7a6-5e4ac8617651","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36510","PortSpecifier":{"PortValue":36510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c110686-738b-49c1-8c24-7b73a88276ee","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36510","PortSpecifier":{"PortValue":36510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":13490593},"http":{"id":"5c110686-738b-49c1-8c24-7b73a88276ee","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5c110686-738b-49c1-8c24-7b73a88276ee"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5c110686-738b-49c1-8c24-7b73a88276ee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":13490593,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36510","port":36510}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c110686-738b-49c1-8c24-7b73a88276ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36518","PortSpecifier":{"PortValue":36518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9052056e-dc13-40dd-bf52-066bd56c1387","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36518","PortSpecifier":{"PortValue":36518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":63804588},"http":{"id":"9052056e-dc13-40dd-bf52-066bd56c1387","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9052056e-dc13-40dd-bf52-066bd56c1387"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9052056e-dc13-40dd-bf52-066bd56c1387","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":63804588,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36518","port":36518}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9052056e-dc13-40dd-bf52-066bd56c1387","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36522","PortSpecifier":{"PortValue":36522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b03ad80-61dc-4025-90cf-f92ec106120a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36522","PortSpecifier":{"PortValue":36522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":112704061},"http":{"id":"3b03ad80-61dc-4025-90cf-f92ec106120a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3b03ad80-61dc-4025-90cf-f92ec106120a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3b03ad80-61dc-4025-90cf-f92ec106120a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":112704061,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36522","port":36522}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b03ad80-61dc-4025-90cf-f92ec106120a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36534","PortSpecifier":{"PortValue":36534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36534","PortSpecifier":{"PortValue":36534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":163402598},"http":{"id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":163402598,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36534","port":36534}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99257c3f-914f-4ea5-9ad6-0baba8c1d1c0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36544","PortSpecifier":{"PortValue":36544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36544","PortSpecifier":{"PortValue":36544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":213395493},"http":{"id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":213395493,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36544","port":36544}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3aa2b882-e8c0-4496-8faa-6757d75b21c8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36560","PortSpecifier":{"PortValue":36560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36560","PortSpecifier":{"PortValue":36560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":262953947},"http":{"id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3d319f26-cce7-46e3-b841-5cb47fbc0926"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":262953947,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36560","port":36560}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d319f26-cce7-46e3-b841-5cb47fbc0926","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36572","PortSpecifier":{"PortValue":36572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36572","PortSpecifier":{"PortValue":36572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":312643855},"http":{"id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"92b166a6-dc8e-4de3-86e1-742f682b4d27"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":312643855,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36572","port":36572}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92b166a6-dc8e-4de3-86e1-742f682b4d27","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36584","PortSpecifier":{"PortValue":36584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:36584","PortSpecifier":{"PortValue":36584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.51:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783369495,"nanos":363441608},"http":{"id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"]}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/295598570635"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=4f9fe48c-b36a-4454-b952-00af4d25b70c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9bd322ba-5309-418a-a8e2-cf1a2ee2adf3","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.51:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** ****REDACTED_JWT****","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.61","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXFqOHB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.133.0.51~maas-default-gateway-openshift-default-5896d4dd49-qj8pt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.61","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":363441608,"seconds":1783369495},"url_path":"/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.61:36584","port":36584}}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:24:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bcefac5c-a894-4f5d-bdc1-c0915b00613e","authorized":true,"response":"OK"}