{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1243957e7492d9a1a2ebc55f33a5309d1fad416b1cccc50526be6257298887ea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1243957e7492d9a1a2ebc55f33a5309d1fad416b1cccc50526be6257298887ea"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427cb015092543477d33b6559fe8fb85ed07d96531d83305d6e76ac4e3517d82","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427cb015092543477d33b6559fe8fb85ed07d96531d83305d6e76ac4e3517d82"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2a159d6e9798c67416d3ef1a1b3502142468fe362955a485651e060eedd301c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2a159d6e9798c67416d3ef1a1b3502142468fe362955a485651e060eedd301c3"}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"846003ed510d437248811d7d6f1a180da697e45b5386625d421ef74dd71182c8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/846003ed510d437248811d7d6f1a180da697e45b5386625d421ef74dd71182c8"}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5b8613c9f83b096bf4d88fa653bfd17e54723ee89b36b5a8a819d4c187dddeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5b8613c9f83b096bf4d88fa653bfd17e54723ee89b36b5a8a819d4c187dddeb"}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"323b5aa67a87f4bbb75410f6526dd6057c69a6ac7ed99a52838319ceb4068fbb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-15T12:59:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a688bf2da7596f4e880d93ba2528f760b3c466409ca8475f7fd7c63f24acf15","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/323b5aa67a87f4bbb75410f6526dd6057c69a6ac7ed99a52838319ceb4068fbb"}
{"level":"debug","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae"}
{"level":"info","ts":"2026-07-15T12:59:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a688bf2da7596f4e880d93ba2528f760b3c466409ca8475f7fd7c63f24acf15"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd574919067688fc19901d760b4b08f91784ac89f3799829f106add1318c799c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0698854e11bd01e545b4962a207e6611f1d6b74e3c2b9cfb9c21a4904c4ec891","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fd574919067688fc19901d760b4b08f91784ac89f3799829f106add1318c799c"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb0af92db3efb412c06471a9905a96dcd6326e81b1cf33f10be76a022b916c71","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0698854e11bd01e545b4962a207e6611f1d6b74e3c2b9cfb9c21a4904c4ec891"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1d47274a7e9b1b67a8cdf9d791496327a8b762a9cb043236c4657056edafe3f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb0af92db3efb412c06471a9905a96dcd6326e81b1cf33f10be76a022b916c71"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e92ee5a6e5d3eeba81d8302be74e16ad8f036bd697ad352e71c4f251505d235d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24456d9618e457ce0f9626fe83e57af67b6d188eeaa3008c83686b897dc1df69","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d47274a7e9b1b67a8cdf9d791496327a8b762a9cb043236c4657056edafe3f6"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93cecee108aa9d455be5bbfd6c07865ebf9166ae4201d129c40f765cc20e0b82","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e92ee5a6e5d3eeba81d8302be74e16ad8f036bd697ad352e71c4f251505d235d"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87a4cc19dc38f527f595a94561ca3e001d2aeec2b856fdb320d6df1a522d6649","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"445577f6cdd7dbeed1e732f48550a17450dabc315098d8601d193715a566ad2a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24456d9618e457ce0f9626fe83e57af67b6d188eeaa3008c83686b897dc1df69"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d3e163471bf8da6514cb18bdfac38b2443cd2cdc3765f59bda02f692ce394265","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a786627f824f831e4e02bc938769ff1204a1262dc43fd8d63eaa354708ac0998","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee987e0a8978b920fb5a27fc01cc159323adb4448a5ab55a4a16ddc6098b7325","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93cecee108aa9d455be5bbfd6c07865ebf9166ae4201d129c40f765cc20e0b82"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1824b31474c57d2f5471c2906b842bb77f15b6bc7e9abf5eac126e5951a63083","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87a4cc19dc38f527f595a94561ca3e001d2aeec2b856fdb320d6df1a522d6649"}
{"level":"debug","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91146886078f91d3494675321c2774d01c91e057502033645481239ac22f928c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/445577f6cdd7dbeed1e732f48550a17450dabc315098d8601d193715a566ad2a"}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d3e163471bf8da6514cb18bdfac38b2443cd2cdc3765f59bda02f692ce394265"}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a786627f824f831e4e02bc938769ff1204a1262dc43fd8d63eaa354708ac0998"}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee987e0a8978b920fb5a27fc01cc159323adb4448a5ab55a4a16ddc6098b7325"}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1824b31474c57d2f5471c2906b842bb77f15b6bc7e9abf5eac126e5951a63083"}
{"level":"info","ts":"2026-07-15T12:59:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91146886078f91d3494675321c2774d01c91e057502033645481239ac22f928c"}
{"level":"info","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45750","PortSpecifier":{"PortValue":45750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61802e34-1a7f-446f-9fb0-594a9ef40610","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45750","PortSpecifier":{"PortValue":45750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120374,"nanos":602381295},"http":{"id":"61802e34-1a7f-446f-9fb0-594a9ef40610","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b6b417e9-42af-4b64-8bb0-853abd468384","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"]}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b6b417e9-42af-4b64-8bb0-853abd468384","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"427cb015092543477d33b6559fe8fb85ed07d96531d83305d6e76ac4e3517d82"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61802e34-1a7f-446f-9fb0-594a9ef40610","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:52516","PortSpecifier":{"PortValue":52516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:52516","PortSpecifier":{"PortValue":52516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120374,"nanos":646187649},"http":{"id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","method":"POST","headers":{":authority":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b6b417e9-42af-4b64-8bb0-853abd468384","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"]}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b6b417e9-42af-4b64-8bb0-853abd468384","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-dc94b0/rate-test-model-dc94b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-dc94b0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"26df319b-6382-447b-89c5-9deb1b0a3cd4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45752","PortSpecifier":{"PortValue":45752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fabf88b0-e81f-4093-8df5-925836dc73d8","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45752","PortSpecifier":{"PortValue":45752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120374,"nanos":689861088},"http":{"id":"fabf88b0-e81f-4093-8df5-925836dc73d8","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11B5I37rNKbl7w6Eb_FzyXfZxPgxRbcqROY55weaVXUCdPPXH4RbbEm0LmFc8"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11B5I37rNKbl7w6Eb_FzyXfZxPgxRbcqROY55weaVXUCdPPXH4RbbEm0LmFc8\"}"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8fdbbbee-f94d-4726-baff-d51675e030a8","keyName":"e2e-rate-a-76051f","subscription":"e2e-rate-iso-a-76051f","tenant":"e2e-shared-a-e6c75d","userId":"8fdbbbee-f94d-4726-baff-d51675e030a8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-76051f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-76051f","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-76051f"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8fdbbbee-f94d-4726-baff-d51675e030a8","keyName":"e2e-rate-a-76051f","selected_subscription":"e2e-rate-iso-a-76051f","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-76051f@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-76051f","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fabf88b0-e81f-4093-8df5-925836dc73d8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45768","PortSpecifier":{"PortValue":45768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45768","PortSpecifier":{"PortValue":45768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120375,"nanos":754240482},"http":{"id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11B5I37rNKbl7w6Eb_FzyXfZxPgxRbcqROY55weaVXUCdPPXH4RbbEm0LmFc8"}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11B5I37rNKbl7w6Eb_FzyXfZxPgxRbcqROY55weaVXUCdPPXH4RbbEm0LmFc8\"}"}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8fdbbbee-f94d-4726-baff-d51675e030a8","keyName":"e2e-rate-a-76051f","subscription":"e2e-rate-iso-a-76051f","tenant":"e2e-shared-a-e6c75d","userId":"8fdbbbee-f94d-4726-baff-d51675e030a8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-76051f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-76051f","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-76051f"}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8fdbbbee-f94d-4726-baff-d51675e030a8","keyName":"e2e-rate-a-76051f","selected_subscription":"e2e-rate-iso-a-76051f","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-76051f@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-76051f","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a78e8d9-d69b-46ce-bd7d-5b904a1c358b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45776","PortSpecifier":{"PortValue":45776}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45776","PortSpecifier":{"PortValue":45776}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120376,"nanos":794848301},"http":{"id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11B5I37rNKbl7w6Eb_FzyXfZxPgxRbcqROY55weaVXUCdPPXH4RbbEm0LmFc8"}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11B5I37rNKbl7w6Eb_FzyXfZxPgxRbcqROY55weaVXUCdPPXH4RbbEm0LmFc8\"}"}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8fdbbbee-f94d-4726-baff-d51675e030a8","keyName":"e2e-rate-a-76051f","subscription":"e2e-rate-iso-a-76051f","tenant":"e2e-shared-a-e6c75d","userId":"8fdbbbee-f94d-4726-baff-d51675e030a8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-76051f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-76051f","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-76051f"}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8fdbbbee-f94d-4726-baff-d51675e030a8","keyName":"e2e-rate-a-76051f","selected_subscription":"e2e-rate-iso-a-76051f","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-76051f@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-76051f","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1d66e98-b7d5-4e6e-8c19-3112f675fc23","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35842","PortSpecifier":{"PortValue":35842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35842","PortSpecifier":{"PortValue":35842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120385,"nanos":607613867},"http":{"id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b6b417e9-42af-4b64-8bb0-853abd468384","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"]}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b6b417e9-42af-4b64-8bb0-853abd468384","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"427cb015092543477d33b6559fe8fb85ed07d96531d83305d6e76ac4e3517d82"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c654be02-57dc-43b8-ae9d-dcf59fcabb88","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"250b18ca-2706-4385-9764-4f59610561f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:38524","PortSpecifier":{"PortValue":38524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"250b18ca-2706-4385-9764-4f59610561f4","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"250b18ca-2706-4385-9764-4f59610561f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:38524","PortSpecifier":{"PortValue":38524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120385,"nanos":648846252},"http":{"id":"250b18ca-2706-4385-9764-4f59610561f4","method":"POST","headers":{":authority":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"250b18ca-2706-4385-9764-4f59610561f4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"250b18ca-2706-4385-9764-4f59610561f4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"b6b417e9-42af-4b64-8bb0-853abd468384","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"]}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"250b18ca-2706-4385-9764-4f59610561f4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9829483d06e8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1e7067fc-e257-4194-b41d-ccba81eb0019"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"b6b417e9-42af-4b64-8bb0-853abd468384","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.77:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"250b18ca-2706-4385-9764-4f59610561f4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"250b18ca-2706-4385-9764-4f59610561f4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"250b18ca-2706-4385-9764-4f59610561f4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-dc94b0/rate-test-model-dc94b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-dc94b0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"250b18ca-2706-4385-9764-4f59610561f4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"250b18ca-2706-4385-9764-4f59610561f4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"250b18ca-2706-4385-9764-4f59610561f4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"250b18ca-2706-4385-9764-4f59610561f4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"250b18ca-2706-4385-9764-4f59610561f4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83a56509-2377-4cf4-b47b-73f70751818d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35854","PortSpecifier":{"PortValue":35854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"83a56509-2377-4cf4-b47b-73f70751818d","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83a56509-2377-4cf4-b47b-73f70751818d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35854","PortSpecifier":{"PortValue":35854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120385,"nanos":687668017},"http":{"id":"83a56509-2377-4cf4-b47b-73f70751818d","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"83a56509-2377-4cf4-b47b-73f70751818d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83a56509-2377-4cf4-b47b-73f70751818d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83a56509-2377-4cf4-b47b-73f70751818d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83a56509-2377-4cf4-b47b-73f70751818d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35856","PortSpecifier":{"PortValue":35856}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35856","PortSpecifier":{"PortValue":35856}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120386,"nanos":730040445},"http":{"id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d76c0f6c-7013-4936-8ab2-4f160616f01c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35858","PortSpecifier":{"PortValue":35858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35858","PortSpecifier":{"PortValue":35858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120387,"nanos":771724692},"http":{"id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"382dd725-dc55-40fd-aa8b-87fa737c5b0e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35874","PortSpecifier":{"PortValue":35874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35874","PortSpecifier":{"PortValue":35874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120388,"nanos":811626804},"http":{"id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbfeaebd-7ee5-4a56-af04-ed66b0fc97ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35882","PortSpecifier":{"PortValue":35882}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35882","PortSpecifier":{"PortValue":35882}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120389,"nanos":850349385},"http":{"id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7ff4a09-239b-45d5-999e-dda278a21d1d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35884","PortSpecifier":{"PortValue":35884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35884","PortSpecifier":{"PortValue":35884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120390,"nanos":888892770},"http":{"id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24db52cf-e323-4d16-b87c-6d6b2f0940c1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42960","PortSpecifier":{"PortValue":42960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42960","PortSpecifier":{"PortValue":42960}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120391,"nanos":930306410},"http":{"id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5fb0fe3-95d5-4003-b443-304c9739f18f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"912929ec-2ace-4670-b976-816d164265c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42968","PortSpecifier":{"PortValue":42968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"912929ec-2ace-4670-b976-816d164265c0","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"912929ec-2ace-4670-b976-816d164265c0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42968","PortSpecifier":{"PortValue":42968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120392,"nanos":967521746},"http":{"id":"912929ec-2ace-4670-b976-816d164265c0","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"912929ec-2ace-4670-b976-816d164265c0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"912929ec-2ace-4670-b976-816d164265c0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"912929ec-2ace-4670-b976-816d164265c0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"912929ec-2ace-4670-b976-816d164265c0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"912929ec-2ace-4670-b976-816d164265c0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"912929ec-2ace-4670-b976-816d164265c0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42972","PortSpecifier":{"PortValue":42972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42972","PortSpecifier":{"PortValue":42972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120394,"nanos":5066044},"http":{"id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b643648-a2ed-4cd4-b4e7-0a95d79f1cef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42974","PortSpecifier":{"PortValue":42974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07ff002e-5001-4ea3-8b12-21872595efbc","method":"POST","path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions","host":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:42974","PortSpecifier":{"PortValue":42974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120395,"nanos":40905024},"http":{"id":"07ff002e-5001-4ea3-8b12-21872595efbc","method":"POST","headers":{":authority":"e2e-shared-a-e6c75d.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GJE4kYnz1Rg55Efw_2ton34LjtYfcmAwuiOgmgxlSkfWC6zLjGelpcxcxu3d\"}"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","subscription":"e2e-rate-iso-a-eb0cfe","tenant":"e2e-shared-a-e6c75d","userId":"17bd3b68-83da-41fa-8253-4597f1f66f37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\",\"requestedSubscription\":\"e2e-rate-iso-a-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e6c75d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e6c75d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"17bd3b68-83da-41fa-8253-4597f1f66f37","keyName":"e2e-rate-a-eb0cfe","selected_subscription":"e2e-rate-iso-a-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e6c75d/e2e-rate-iso-a-eb0cfe@ai-tenant-e2e-shared-a-e6c75d/rate-test-model-e6c75d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e6c75d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-eb0cfe","namespace":"ai-tenant-e2e-shared-a-e6c75d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07ff002e-5001-4ea3-8b12-21872595efbc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45138","PortSpecifier":{"PortValue":45138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","method":"POST","path":"/ai-tenant-e2e-shared-b-dc94b0/rate-test-model-dc94b0/v1/completions","host":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:45138","PortSpecifier":{"PortValue":45138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.77:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784120395,"nanos":74130771},"http":{"id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","method":"POST","headers":{":authority":"e2e-shared-b-dc94b0.apps.8002d0d7-e583-4c9d-9d4d-9829483d06e8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-dc94b0/rate-test-model-dc94b0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-fmRR73orIX8lIKCU_Z2b8t29CsxIz6SS1DhJkWQRjgEdT1Soztg3bKF6ebOC"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-dc94b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-fmRR73orIX8lIKCU_Z2b8t29CsxIz6SS1DhJkWQRjgEdT1Soztg3bKF6ebOC\"}"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-dc94b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f345c727-fea3-47ed-be7e-60cd26bd4f45","keyName":"e2e-rate-b-eb0cfe","subscription":"e2e-rate-iso-b-eb0cfe","tenant":"e2e-shared-b-dc94b0","userId":"f345c727-fea3-47ed-be7e-60cd26bd4f45","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-dc94b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-dc94b0/rate-test-model-dc94b0\",\"requestedSubscription\":\"e2e-rate-iso-b-eb0cfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-dc94b0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-dc94b0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-eb0cfe","namespace":"ai-tenant-e2e-shared-b-dc94b0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-dc94b0/rate-test-model-dc94b0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-dc94b0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-eb0cfe"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f345c727-fea3-47ed-be7e-60cd26bd4f45","keyName":"e2e-rate-b-eb0cfe","selected_subscription":"e2e-rate-iso-b-eb0cfe","selected_subscription_key":"ai-tenant-e2e-shared-b-dc94b0/e2e-rate-iso-b-eb0cfe@ai-tenant-e2e-shared-b-dc94b0/rate-test-model-dc94b0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-dc94b0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-eb0cfe","namespace":"ai-tenant-e2e-shared-b-dc94b0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-15T12:59:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3529d43a-7cde-4461-acc6-28c2c7c94ccd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-15T13:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/91146886078f91d3494675321c2774d01c91e057502033645481239ac22f928c"}
{"level":"info","ts":"2026-07-15T13:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1243957e7492d9a1a2ebc55f33a5309d1fad416b1cccc50526be6257298887ea"}
{"level":"info","ts":"2026-07-15T13:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/846003ed510d437248811d7d6f1a180da697e45b5386625d421ef74dd71182c8"}
{"level":"info","ts":"2026-07-15T13:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87a4cc19dc38f527f595a94561ca3e001d2aeec2b856fdb320d6df1a522d6649"}
{"level":"info","ts":"2026-07-15T13:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/445577f6cdd7dbeed1e732f48550a17450dabc315098d8601d193715a566ad2a"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/323b5aa67a87f4bbb75410f6526dd6057c69a6ac7ed99a52838319ceb4068fbb"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d47274a7e9b1b67a8cdf9d791496327a8b762a9cb043236c4657056edafe3f6"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8dec75bd0f04a15bdec1bda7178fd9fb63eccd60bca311d230fb70a247d752a4"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d3e163471bf8da6514cb18bdfac38b2443cd2cdc3765f59bda02f692ce394265"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1824b31474c57d2f5471c2906b842bb77f15b6bc7e9abf5eac126e5951a63083"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1885532f3ed5d25bfaf54864572a000d01f375d45e6b7e6500c9bf4595362444"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e92ee5a6e5d3eeba81d8302be74e16ad8f036bd697ad352e71c4f251505d235d"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a786627f824f831e4e02bc938769ff1204a1262dc43fd8d63eaa354708ac0998"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/93cecee108aa9d455be5bbfd6c07865ebf9166ae4201d129c40f765cc20e0b82"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/24456d9618e457ce0f9626fe83e57af67b6d188eeaa3008c83686b897dc1df69"}
{"level":"info","ts":"2026-07-15T13:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fd574919067688fc19901d760b4b08f91784ac89f3799829f106add1318c799c"}
{"level":"info","ts":"2026-07-15T13:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a688bf2da7596f4e880d93ba2528f760b3c466409ca8475f7fd7c63f24acf15"}
{"level":"info","ts":"2026-07-15T13:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee987e0a8978b920fb5a27fc01cc159323adb4448a5ab55a4a16ddc6098b7325"}
{"level":"info","ts":"2026-07-15T13:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2a159d6e9798c67416d3ef1a1b3502142468fe362955a485651e060eedd301c3"}
{"level":"info","ts":"2026-07-15T13:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/427cb015092543477d33b6559fe8fb85ed07d96531d83305d6e76ac4e3517d82"}
{"level":"info","ts":"2026-07-15T13:00:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a5b8613c9f83b096bf4d88fa653bfd17e54723ee89b36b5a8a819d4c187dddeb"}
{"level":"info","ts":"2026-07-15T13:00:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0698854e11bd01e545b4962a207e6611f1d6b74e3c2b9cfb9c21a4904c4ec891"}
{"level":"info","ts":"2026-07-15T13:00:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/81b666b3ba065e18cab343da954bce6f16fb74f0ffa445b42732219f0cd594ae"}
{"level":"info","ts":"2026-07-15T13:00:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb0af92db3efb412c06471a9905a96dcd6326e81b1cf33f10be76a022b916c71"}