{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1a2fca23058889693cce44674641402a52c20cbbf42198760f2fc4ef0dd0516","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a1a2fca23058889693cce44674641402a52c20cbbf42198760f2fc4ef0dd0516"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1a2fca23058889693cce44674641402a52c20cbbf42198760f2fc4ef0dd0516","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1a2fca23058889693cce44674641402a52c20cbbf42198760f2fc4ef0dd0516","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43"}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1a2fca23058889693cce44674641402a52c20cbbf42198760f2fc4ef0dd0516"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56"}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56"}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c881ca15369514375279ee06e499bfe0c6290dfb50526e1a1e8a48defcf0de6"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c881ca15369514375279ee06e499bfe0c6290dfb50526e1a1e8a48defcf0de6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0c881ca15369514375279ee06e499bfe0c6290dfb50526e1a1e8a48defcf0de6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c881ca15369514375279ee06e499bfe0c6290dfb50526e1a1e8a48defcf0de6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2175f018302ca078fd26849ee7dcfa524696bc507e3a27249fd57a372e578a2c"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cfda08bbe096b2ff41428e32a1e3b1f2572442ef7df7b247613e75876a7d9d3"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2175f018302ca078fd26849ee7dcfa524696bc507e3a27249fd57a372e578a2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2175f018302ca078fd26849ee7dcfa524696bc507e3a27249fd57a372e578a2c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c881ca15369514375279ee06e499bfe0c6290dfb50526e1a1e8a48defcf0de6"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e232fde2d13b893bf10d644a6fd69f8319382ae68be0af767a3604b8b71da415"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2175f018302ca078fd26849ee7dcfa524696bc507e3a27249fd57a372e578a2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cfda08bbe096b2ff41428e32a1e3b1f2572442ef7df7b247613e75876a7d9d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5cfda08bbe096b2ff41428e32a1e3b1f2572442ef7df7b247613e75876a7d9d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7289f7eaf1a78f746650bb59360fe0b4da3cdace03bc38a7a2a275d0dab2a2c"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cfda08bbe096b2ff41428e32a1e3b1f2572442ef7df7b247613e75876a7d9d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c881ca15369514375279ee06e499bfe0c6290dfb50526e1a1e8a48defcf0de6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e232fde2d13b893bf10d644a6fd69f8319382ae68be0af767a3604b8b71da415","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e232fde2d13b893bf10d644a6fd69f8319382ae68be0af767a3604b8b71da415"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2175f018302ca078fd26849ee7dcfa524696bc507e3a27249fd57a372e578a2c"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/501d25ebfe6cc9235804b6371b2b3359283b884a286beeb081da0a6a7e16b65d"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e232fde2d13b893bf10d644a6fd69f8319382ae68be0af767a3604b8b71da415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7289f7eaf1a78f746650bb59360fe0b4da3cdace03bc38a7a2a275d0dab2a2c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7289f7eaf1a78f746650bb59360fe0b4da3cdace03bc38a7a2a275d0dab2a2c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cfda08bbe096b2ff41428e32a1e3b1f2572442ef7df7b247613e75876a7d9d3"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a16bdf9a5573842c4b26e893de628066bf65d290c7c5f32064cce8ac4d4e37b9"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7289f7eaf1a78f746650bb59360fe0b4da3cdace03bc38a7a2a275d0dab2a2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51721dec77defe6d73bf0e1f3edf097bd684adbc2aa98ffc87577162ab532e39"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e232fde2d13b893bf10d644a6fd69f8319382ae68be0af767a3604b8b71da415"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2175f018302ca078fd26849ee7dcfa524696bc507e3a27249fd57a372e578a2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"501d25ebfe6cc9235804b6371b2b3359283b884a286beeb081da0a6a7e16b65d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["501d25ebfe6cc9235804b6371b2b3359283b884a286beeb081da0a6a7e16b65d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/541fb392bb97327dc263a5e6f9814010ef3b99857e0f3cd6055caae7cbf223d4"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7289f7eaf1a78f746650bb59360fe0b4da3cdace03bc38a7a2a275d0dab2a2c"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"501d25ebfe6cc9235804b6371b2b3359283b884a286beeb081da0a6a7e16b65d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cfda08bbe096b2ff41428e32a1e3b1f2572442ef7df7b247613e75876a7d9d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a16bdf9a5573842c4b26e893de628066bf65d290c7c5f32064cce8ac4d4e37b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a16bdf9a5573842c4b26e893de628066bf65d290c7c5f32064cce8ac4d4e37b9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/164c3ecf3bbacb2a27f839a6f7579a2c5aac80524019cfbb682f112b4e5611a0"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a16bdf9a5573842c4b26e893de628066bf65d290c7c5f32064cce8ac4d4e37b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51721dec77defe6d73bf0e1f3edf097bd684adbc2aa98ffc87577162ab532e39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51721dec77defe6d73bf0e1f3edf097bd684adbc2aa98ffc87577162ab532e39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/501d25ebfe6cc9235804b6371b2b3359283b884a286beeb081da0a6a7e16b65d"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a16bdf9a5573842c4b26e893de628066bf65d290c7c5f32064cce8ac4d4e37b9"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51721dec77defe6d73bf0e1f3edf097bd684adbc2aa98ffc87577162ab532e39","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e232fde2d13b893bf10d644a6fd69f8319382ae68be0af767a3604b8b71da415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"541fb392bb97327dc263a5e6f9814010ef3b99857e0f3cd6055caae7cbf223d4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["541fb392bb97327dc263a5e6f9814010ef3b99857e0f3cd6055caae7cbf223d4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51721dec77defe6d73bf0e1f3edf097bd684adbc2aa98ffc87577162ab532e39"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"541fb392bb97327dc263a5e6f9814010ef3b99857e0f3cd6055caae7cbf223d4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7289f7eaf1a78f746650bb59360fe0b4da3cdace03bc38a7a2a275d0dab2a2c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"164c3ecf3bbacb2a27f839a6f7579a2c5aac80524019cfbb682f112b4e5611a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["164c3ecf3bbacb2a27f839a6f7579a2c5aac80524019cfbb682f112b4e5611a0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/541fb392bb97327dc263a5e6f9814010ef3b99857e0f3cd6055caae7cbf223d4"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"164c3ecf3bbacb2a27f839a6f7579a2c5aac80524019cfbb682f112b4e5611a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/164c3ecf3bbacb2a27f839a6f7579a2c5aac80524019cfbb682f112b4e5611a0"}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"501d25ebfe6cc9235804b6371b2b3359283b884a286beeb081da0a6a7e16b65d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a16bdf9a5573842c4b26e893de628066bf65d290c7c5f32064cce8ac4d4e37b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51721dec77defe6d73bf0e1f3edf097bd684adbc2aa98ffc87577162ab532e39","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"541fb392bb97327dc263a5e6f9814010ef3b99857e0f3cd6055caae7cbf223d4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"164c3ecf3bbacb2a27f839a6f7579a2c5aac80524019cfbb682f112b4e5611a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-21T14:29:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-21T14:29:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-21T14:29:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-21T14:29:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-21T14:29:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"}
{"level":"info","ts":"2026-07-21T14:29:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39296","PortSpecifier":{"PortValue":39296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39296","PortSpecifier":{"PortValue":39296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644149,"nanos":996314548},"http":{"id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"]}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"500d18ea-fdb3-4278-9184-1bdda76b86fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47824","PortSpecifier":{"PortValue":47824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:47824","PortSpecifier":{"PortValue":47824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644150,"nanos":44227920},"http":{"id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","method":"POST","headers":{":authority":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"]}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.69:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52967c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a0d73b9-d716-4b82-87b3-9888f08c7f28","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39302","PortSpecifier":{"PortValue":39302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39302","PortSpecifier":{"PortValue":39302}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644150,"nanos":91858223},"http":{"id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"865843b6-85a5-4e61-9de5-ab01ef9e270d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39306","PortSpecifier":{"PortValue":39306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1226b641-2dc7-4679-8f2c-b6072648c242","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39306","PortSpecifier":{"PortValue":39306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644151,"nanos":153970218},"http":{"id":"1226b641-2dc7-4679-8f2c-b6072648c242","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1226b641-2dc7-4679-8f2c-b6072648c242","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39316","PortSpecifier":{"PortValue":39316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39316","PortSpecifier":{"PortValue":39316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644152,"nanos":192671277},"http":{"id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c947967d-a9a8-4660-a3bf-2c0791d47e22","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39326","PortSpecifier":{"PortValue":39326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39326","PortSpecifier":{"PortValue":39326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644153,"nanos":231661036},"http":{"id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebd6c27-17e5-4f06-9ad5-e9f3502f952e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39336","PortSpecifier":{"PortValue":39336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61fed81e-8f33-430a-84e0-6572ddfa520f","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39336","PortSpecifier":{"PortValue":39336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644154,"nanos":269427270},"http":{"id":"61fed81e-8f33-430a-84e0-6572ddfa520f","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61fed81e-8f33-430a-84e0-6572ddfa520f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39346","PortSpecifier":{"PortValue":39346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39346","PortSpecifier":{"PortValue":39346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644155,"nanos":319349741},"http":{"id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44522e5f-4f0f-440e-bc6a-494e411b6fbe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39362","PortSpecifier":{"PortValue":39362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:39362","PortSpecifier":{"PortValue":39362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644156,"nanos":366882103},"http":{"id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"727754b2-1327-4ba4-8d9d-bbdb037398e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48600","PortSpecifier":{"PortValue":48600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"056e575a-854f-482b-a3c1-8c3e020603f1","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:48600","PortSpecifier":{"PortValue":48600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644157,"nanos":407198477},"http":{"id":"056e575a-854f-482b-a3c1-8c3e020603f1","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2"}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECPzLD5THELX5Rgb_kXWnwdvuKh2jJEyJRbAGV8JYBjjlPMDakGbp6JlErE2\"}"}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","subscription":"e2e-rate-iso-a-a673b3","tenant":"e2e-shared-a-67be07","userId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-a673b3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a673b3"}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1e440ad6-d0a1-4768-876a-ac06899bbbfd","keyName":"e2e-rate-a-a673b3","selected_subscription":"e2e-rate-iso-a-a673b3","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-a673b3@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a673b3","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"056e575a-854f-482b-a3c1-8c3e020603f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51370","PortSpecifier":{"PortValue":51370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51370","PortSpecifier":{"PortValue":51370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644168,"nanos":161570218},"http":{"id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"]}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cec85bbd-8402-457a-8a1d-87baebaf9cff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"259ef99e-4335-49f3-b913-32fde46a3673","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:46960","PortSpecifier":{"PortValue":46960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"259ef99e-4335-49f3-b913-32fde46a3673","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"259ef99e-4335-49f3-b913-32fde46a3673","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:46960","PortSpecifier":{"PortValue":46960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644168,"nanos":203762319},"http":{"id":"259ef99e-4335-49f3-b913-32fde46a3673","method":"POST","headers":{":authority":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"259ef99e-4335-49f3-b913-32fde46a3673","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"259ef99e-4335-49f3-b913-32fde46a3673","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"]}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"259ef99e-4335-49f3-b913-32fde46a3673","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f501dc36bfbb"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69bd14ba-7c3b-4214-abdc-648afc7bb592"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"c9d8e713-ec08-4892-a56e-7b129733ef25","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.69:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"259ef99e-4335-49f3-b913-32fde46a3673","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"259ef99e-4335-49f3-b913-32fde46a3673","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"259ef99e-4335-49f3-b913-32fde46a3673","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52967c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"259ef99e-4335-49f3-b913-32fde46a3673","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"259ef99e-4335-49f3-b913-32fde46a3673","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"259ef99e-4335-49f3-b913-32fde46a3673","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"259ef99e-4335-49f3-b913-32fde46a3673","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"259ef99e-4335-49f3-b913-32fde46a3673","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51382","PortSpecifier":{"PortValue":51382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"817d6719-1de0-49b7-addd-621b51f47dd8","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51382","PortSpecifier":{"PortValue":51382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644168,"nanos":246157849},"http":{"id":"817d6719-1de0-49b7-addd-621b51f47dd8","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Y1UCS9QPQWW644Oy_y1HGSlP6wRhNHrWBtLTYWA0b7Ek0MIrz4dfMrDwvxti"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Y1UCS9QPQWW644Oy_y1HGSlP6wRhNHrWBtLTYWA0b7Ek0MIrz4dfMrDwvxti\"}"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","keyName":"e2e-rate-a-32cc70","subscription":"e2e-rate-iso-a-32cc70","tenant":"e2e-shared-a-67be07","userId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-32cc70\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-32cc70","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-32cc70"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","keyName":"e2e-rate-a-32cc70","selected_subscription":"e2e-rate-iso-a-32cc70","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-32cc70@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-32cc70","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"817d6719-1de0-49b7-addd-621b51f47dd8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51390","PortSpecifier":{"PortValue":51390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51390","PortSpecifier":{"PortValue":51390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644169,"nanos":287644450},"http":{"id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Y1UCS9QPQWW644Oy_y1HGSlP6wRhNHrWBtLTYWA0b7Ek0MIrz4dfMrDwvxti"}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Y1UCS9QPQWW644Oy_y1HGSlP6wRhNHrWBtLTYWA0b7Ek0MIrz4dfMrDwvxti\"}"}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","keyName":"e2e-rate-a-32cc70","subscription":"e2e-rate-iso-a-32cc70","tenant":"e2e-shared-a-67be07","userId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-32cc70\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-32cc70","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-32cc70"}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","keyName":"e2e-rate-a-32cc70","selected_subscription":"e2e-rate-iso-a-32cc70","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-32cc70@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-32cc70","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffeb7d19-c95e-427f-8c23-855fcc6f1080","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51402","PortSpecifier":{"PortValue":51402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","method":"POST","path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions","host":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:51402","PortSpecifier":{"PortValue":51402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644170,"nanos":333565731},"http":{"id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","method":"POST","headers":{":authority":"e2e-shared-a-67be07.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Y1UCS9QPQWW644Oy_y1HGSlP6wRhNHrWBtLTYWA0b7Ek0MIrz4dfMrDwvxti"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Y1UCS9QPQWW644Oy_y1HGSlP6wRhNHrWBtLTYWA0b7Ek0MIrz4dfMrDwvxti\"}"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","keyName":"e2e-rate-a-32cc70","subscription":"e2e-rate-iso-a-32cc70","tenant":"e2e-shared-a-67be07","userId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\",\"requestedSubscription\":\"e2e-rate-iso-a-32cc70\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67be07.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-32cc70","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67be07/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-32cc70"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"162f4bbb-8dd5-4045-80c8-03685e23cff5","keyName":"e2e-rate-a-32cc70","selected_subscription":"e2e-rate-iso-a-32cc70","selected_subscription_key":"ai-tenant-e2e-shared-a-67be07/e2e-rate-iso-a-32cc70@ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-67be07","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-32cc70","namespace":"ai-tenant-e2e-shared-a-67be07","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67be07/rate-test-model-67be07"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83c1d94d-3ba4-4e94-8656-d6fa09d381fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:46976","PortSpecifier":{"PortValue":46976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","method":"POST","path":"/ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c/v1/completions","host":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.8:46976","PortSpecifier":{"PortValue":46976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784644170,"nanos":372407352},"http":{"id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","method":"POST","headers":{":authority":"e2e-shared-b-52967c.apps.23a923bc-ec4f-4a81-9def-f501dc36bfbb.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18k3MCr8miSzfXVTz_sqf803Qk85cAjUHtsCsyAYxdvHYEDRkEo7JlFYcPxZk"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-52967c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18k3MCr8miSzfXVTz_sqf803Qk85cAjUHtsCsyAYxdvHYEDRkEo7JlFYcPxZk\"}"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52967c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"316942fd-3a19-4e46-a3a0-d4f1f82361b9","keyName":"e2e-rate-b-32cc70","subscription":"e2e-rate-iso-b-32cc70","tenant":"e2e-shared-b-52967c","userId":"316942fd-3a19-4e46-a3a0-d4f1f82361b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-52967c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c\",\"requestedSubscription\":\"e2e-rate-iso-b-32cc70\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52967c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-52967c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-32cc70","namespace":"ai-tenant-e2e-shared-b-52967c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c"}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52967c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-32cc70"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"316942fd-3a19-4e46-a3a0-d4f1f82361b9","keyName":"e2e-rate-b-32cc70","selected_subscription":"e2e-rate-iso-b-32cc70","selected_subscription_key":"ai-tenant-e2e-shared-b-52967c/e2e-rate-iso-b-32cc70@ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-52967c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-32cc70","namespace":"ai-tenant-e2e-shared-b-52967c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-52967c/rate-test-model-52967c"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-21T14:29:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41f53f70-5fa2-4b41-9ed1-17ea9d7bd75f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e232fde2d13b893bf10d644a6fd69f8319382ae68be0af767a3604b8b71da415"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0c881ca15369514375279ee06e499bfe0c6290dfb50526e1a1e8a48defcf0de6"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5cfda08bbe096b2ff41428e32a1e3b1f2572442ef7df7b247613e75876a7d9d3"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7289f7eaf1a78f746650bb59360fe0b4da3cdace03bc38a7a2a275d0dab2a2c"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a49d36af439da6929b789ff09c9b99ccd85d01ff7fd730be5e93c61ffbc2f3c4"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c954eb52d50bc15d271918140fcc8e30aa07800f6f191be3aa94b08859f61b3f"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ea60c2365c53b809aaabeb24bac92d3f0696673969add8795cbbed1d59d2627"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2175f018302ca078fd26849ee7dcfa524696bc507e3a27249fd57a372e578a2c"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db5262dfb4dd4dae2df816f397482a4f55e5788e2464f410fb424f9cc4a591d2"}
{"level":"info","ts":"2026-07-21T14:29:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a16bdf9a5573842c4b26e893de628066bf65d290c7c5f32064cce8ac4d4e37b9"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/501d25ebfe6cc9235804b6371b2b3359283b884a286beeb081da0a6a7e16b65d"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/541fb392bb97327dc263a5e6f9814010ef3b99857e0f3cd6055caae7cbf223d4"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dde0d21848e50fe49a251ed778927e0e39cce96721fbbc03729cc6d388cbbc9d"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1eddda6d459b295395471a559ae4bf6f13707d14e3c2bea18048c4e37642e5cd"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51721dec77defe6d73bf0e1f3edf097bd684adbc2aa98ffc87577162ab532e39"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/38d9bae64fe54c9ea675707bc5b247dfa2817eb3f6d64c6ecca777a451e94a56"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/262624894acafba69c251a1ae347d25872fabe56bd174adb71221c931cab5e4b"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/164c3ecf3bbacb2a27f839a6f7579a2c5aac80524019cfbb682f112b4e5611a0"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc2875fa11953cb56ffe9a8b1e9ae2eac0844823c15060e33c2f164e7af1a264"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87c09ed44f57f9292c13af66cf36b9fe199c4cd44eb312ec7e4ffa929f9d4e2b"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8d0686a50e7d1402fdd8dd17bc7b97614fd40cbff4191fa210bb147ad2f45a6"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ac703be776d66a6f7773c15c3d671626bb1f094034d8914101858d24ca6d890"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8da8c8de34fa3c3e489360173a12a080974dfbde2e0b1bbe10d6ec276dff2f43"}
{"level":"info","ts":"2026-07-21T14:29:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1a2fca23058889693cce44674641402a52c20cbbf42198760f2fc4ef0dd0516"}