--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"74ecf3c8-7a68-4db2-a334-5105b3f77340"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":779536033,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41482},"address":"10.133.0.28:41482"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74ecf3c8-7a68-4db2-a334-5105b3f77340","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41484","PortSpecifier":{"PortValue":41484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1c953930-9cb8-4b09-890c-f9314bb1862a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41484","PortSpecifier":{"PortValue":41484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":791389080},"http":{"id":"1c953930-9cb8-4b09-890c-f9314bb1862a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1c953930-9cb8-4b09-890c-f9314bb1862a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1c953930-9cb8-4b09-890c-f9314bb1862a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":791389080,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41484},"address":"10.133.0.28:41484"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c953930-9cb8-4b09-890c-f9314bb1862a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41492","PortSpecifier":{"PortValue":41492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d139e26-1b18-4f09-9385-f0e91d26632b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41492","PortSpecifier":{"PortValue":41492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":803121493},"http":{"id":"9d139e26-1b18-4f09-9385-f0e91d26632b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9d139e26-1b18-4f09-9385-f0e91d26632b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9d139e26-1b18-4f09-9385-f0e91d26632b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":803121493,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41492},"address":"10.133.0.28:41492"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d139e26-1b18-4f09-9385-f0e91d26632b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41496","PortSpecifier":{"PortValue":41496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41496","PortSpecifier":{"PortValue":41496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":830193717},"http":{"id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"668e521e-d146-44a6-b5b1-70b6da4a57ef"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":830193717,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41496},"address":"10.133.0.28:41496"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"668e521e-d146-44a6-b5b1-70b6da4a57ef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":841516524},"http":{"id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":841516524,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41510},"address":"10.133.0.28:41510"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dccbbddf-4d84-422d-aaf2-71f4ebc3b455","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41518","PortSpecifier":{"PortValue":41518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41518","PortSpecifier":{"PortValue":41518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":852998216},"http":{"id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":852998216,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41518},"address":"10.133.0.28:41518"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31d7efc6-6beb-4de5-a6a6-4a49700e9ff3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41524","PortSpecifier":{"PortValue":41524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41524","PortSpecifier":{"PortValue":41524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":864736790},"http":{"id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":864736790,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41524},"address":"10.133.0.28:41524"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8989e5d0-aef9-46d4-b0c7-8a06ecbdb853","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41536","PortSpecifier":{"PortValue":41536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41536","PortSpecifier":{"PortValue":41536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":876190118},"http":{"id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":876190118,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41536},"address":"10.133.0.28:41536"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ed0a5ec-631e-41e3-bd90-3478c1004f72","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41542","PortSpecifier":{"PortValue":41542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41542","PortSpecifier":{"PortValue":41542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":888201819},"http":{"id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":888201819,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41542},"address":"10.133.0.28:41542"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91176349-bcf1-4e6e-b7aa-84656c83ba6f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41546","PortSpecifier":{"PortValue":41546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41546","PortSpecifier":{"PortValue":41546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":926953428},"http":{"id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":926953428,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41546},"address":"10.133.0.28:41546"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ba65bd1-13ab-4cbe-ac4b-7e2daeb29129","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41548","PortSpecifier":{"PortValue":41548}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2f084d91-9216-4843-9454-2bde9cd65df5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41548","PortSpecifier":{"PortValue":41548}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":939464234},"http":{"id":"2f084d91-9216-4843-9454-2bde9cd65df5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2f084d91-9216-4843-9454-2bde9cd65df5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2f084d91-9216-4843-9454-2bde9cd65df5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":939464234,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41548},"address":"10.133.0.28:41548"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f084d91-9216-4843-9454-2bde9cd65df5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41552","PortSpecifier":{"PortValue":41552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41552","PortSpecifier":{"PortValue":41552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":951623229},"http":{"id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":951623229,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41552},"address":"10.133.0.28:41552"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63ff85ab-6bb4-4785-9475-3660e4e6a0d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"044aec47-e160-4b80-a847-c961b53ea5de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41560","PortSpecifier":{"PortValue":41560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"044aec47-e160-4b80-a847-c961b53ea5de","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"044aec47-e160-4b80-a847-c961b53ea5de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41560","PortSpecifier":{"PortValue":41560}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":963186438},"http":{"id":"044aec47-e160-4b80-a847-c961b53ea5de","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"044aec47-e160-4b80-a847-c961b53ea5de","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"044aec47-e160-4b80-a847-c961b53ea5de","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"044aec47-e160-4b80-a847-c961b53ea5de","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"044aec47-e160-4b80-a847-c961b53ea5de","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"044aec47-e160-4b80-a847-c961b53ea5de"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"044aec47-e160-4b80-a847-c961b53ea5de","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":963186438,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41560},"address":"10.133.0.28:41560"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"044aec47-e160-4b80-a847-c961b53ea5de","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"044aec47-e160-4b80-a847-c961b53ea5de","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"044aec47-e160-4b80-a847-c961b53ea5de","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41568","PortSpecifier":{"PortValue":41568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41568","PortSpecifier":{"PortValue":41568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":974700268},"http":{"id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":974700268,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41568},"address":"10.133.0.28:41568"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"184bfb2e-5c2a-44e2-b5d4-654a3f18b5b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41578","PortSpecifier":{"PortValue":41578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41578","PortSpecifier":{"PortValue":41578}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":986992817},"http":{"id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":986992817,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41578},"address":"10.133.0.28:41578"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a55bd7a7-29ab-4594-ad5a-2d97ce28000c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41582","PortSpecifier":{"PortValue":41582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41582","PortSpecifier":{"PortValue":41582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893576,"nanos":998325865},"http":{"id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":998325865,"seconds":1783893576}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41582},"address":"10.133.0.28:41582"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a83eaaa-633a-49ab-89e4-9c168f2b6281","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41588","PortSpecifier":{"PortValue":41588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41588","PortSpecifier":{"PortValue":41588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":10248624},"http":{"id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f50bd851-2303-4ec8-b76d-9b9f2619036a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":10248624,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41588},"address":"10.133.0.28:41588"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f50bd851-2303-4ec8-b76d-9b9f2619036a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41592","PortSpecifier":{"PortValue":41592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41592","PortSpecifier":{"PortValue":41592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":31658701},"http":{"id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":31658701,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41592},"address":"10.133.0.28:41592"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84a5a4bb-de5a-434e-ba31-55e6694eb6c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41596","PortSpecifier":{"PortValue":41596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41596","PortSpecifier":{"PortValue":41596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":43724709},"http":{"id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":43724709,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41596},"address":"10.133.0.28:41596"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab7b4e80-2e64-4ba5-90e6-bfb82ca518c8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41602","PortSpecifier":{"PortValue":41602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93fb3315-0587-4d95-ab9f-3d729c02bace","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41602","PortSpecifier":{"PortValue":41602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":56122285},"http":{"id":"93fb3315-0587-4d95-ab9f-3d729c02bace","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"93fb3315-0587-4d95-ab9f-3d729c02bace"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"93fb3315-0587-4d95-ab9f-3d729c02bace","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":56122285,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41602},"address":"10.133.0.28:41602"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93fb3315-0587-4d95-ab9f-3d729c02bace","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41606","PortSpecifier":{"PortValue":41606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41606","PortSpecifier":{"PortValue":41606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":136434681},"http":{"id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":136434681,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41606},"address":"10.133.0.28:41606"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aaf2e4f2-efa6-4fd6-94e2-51697b5e1738","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41612","PortSpecifier":{"PortValue":41612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41612","PortSpecifier":{"PortValue":41612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":331368768},"http":{"id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":331368768,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41612},"address":"10.133.0.28:41612"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"118f9c42-6afe-4f04-adcb-ba1ce2b54f7b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41620","PortSpecifier":{"PortValue":41620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41620","PortSpecifier":{"PortValue":41620}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":344230470},"http":{"id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":344230470,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41620},"address":"10.133.0.28:41620"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd66f622-7edc-4064-8d2b-af1c5728ea2f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a128908-7808-4592-b096-da61d7a14645","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41622","PortSpecifier":{"PortValue":41622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a128908-7808-4592-b096-da61d7a14645","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a128908-7808-4592-b096-da61d7a14645","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41622","PortSpecifier":{"PortValue":41622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":356065187},"http":{"id":"3a128908-7808-4592-b096-da61d7a14645","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3a128908-7808-4592-b096-da61d7a14645","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a128908-7808-4592-b096-da61d7a14645","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3a128908-7808-4592-b096-da61d7a14645"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3a128908-7808-4592-b096-da61d7a14645","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":356065187,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41622},"address":"10.133.0.28:41622"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a128908-7808-4592-b096-da61d7a14645","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a128908-7808-4592-b096-da61d7a14645","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a128908-7808-4592-b096-da61d7a14645","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41630","PortSpecifier":{"PortValue":41630}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41630","PortSpecifier":{"PortValue":41630}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":429181938},"http":{"id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"25e405a5-6be7-4ef4-98cc-a48529657bdd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":429181938,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41630},"address":"10.133.0.28:41630"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25e405a5-6be7-4ef4-98cc-a48529657bdd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41632","PortSpecifier":{"PortValue":41632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41632","PortSpecifier":{"PortValue":41632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":441493921},"http":{"id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":441493921,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41632},"address":"10.133.0.28:41632"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c0e46ba-1ac5-4424-9cc6-14ea717b411e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41636","PortSpecifier":{"PortValue":41636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41636","PortSpecifier":{"PortValue":41636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":453373999},"http":{"id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3bf7fc74-b6fd-4258-8505-8f1e49856040"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":453373999,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41636},"address":"10.133.0.28:41636"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bf7fc74-b6fd-4258-8505-8f1e49856040","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41638","PortSpecifier":{"PortValue":41638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"33b7114e-8c01-46bb-958c-b6810b138eec","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41638","PortSpecifier":{"PortValue":41638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":464821221},"http":{"id":"33b7114e-8c01-46bb-958c-b6810b138eec","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"33b7114e-8c01-46bb-958c-b6810b138eec"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"33b7114e-8c01-46bb-958c-b6810b138eec","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":464821221,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41638},"address":"10.133.0.28:41638"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33b7114e-8c01-46bb-958c-b6810b138eec","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41640","PortSpecifier":{"PortValue":41640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41640","PortSpecifier":{"PortValue":41640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":476445944},"http":{"id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ddd5c5c5-fdae-474f-939b-330f97c247b4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":476445944,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41640},"address":"10.133.0.28:41640"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddd5c5c5-fdae-474f-939b-330f97c247b4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41656","PortSpecifier":{"PortValue":41656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41656","PortSpecifier":{"PortValue":41656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":488211546},"http":{"id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":488211546,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41656},"address":"10.133.0.28:41656"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9f137a6-5ef6-47ff-8f35-79f5facfa312","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41660","PortSpecifier":{"PortValue":41660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41660","PortSpecifier":{"PortValue":41660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":499564282},"http":{"id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":499564282,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41660},"address":"10.133.0.28:41660"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a1564a5-3559-42f0-94af-7f1cb9d9e754","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41674","PortSpecifier":{"PortValue":41674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41674","PortSpecifier":{"PortValue":41674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":530263884},"http":{"id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":530263884,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41674},"address":"10.133.0.28:41674"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6471cf64-fbd2-4080-9e48-8a0c9b48da8c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41690","PortSpecifier":{"PortValue":41690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41690","PortSpecifier":{"PortValue":41690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":541821690},"http":{"id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":541821690,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41690},"address":"10.133.0.28:41690"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf80dd6f-de91-448c-add5-7fa3ad40f4fe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41700","PortSpecifier":{"PortValue":41700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41700","PortSpecifier":{"PortValue":41700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":553227311},"http":{"id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":553227311,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41700},"address":"10.133.0.28:41700"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d43cc22-13ad-43df-abec-0a7ac1d5180e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41710","PortSpecifier":{"PortValue":41710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01910780-7719-4b9c-b6ea-2af4ab505c77","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41710","PortSpecifier":{"PortValue":41710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":564572107},"http":{"id":"01910780-7719-4b9c-b6ea-2af4ab505c77","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"01910780-7719-4b9c-b6ea-2af4ab505c77"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"01910780-7719-4b9c-b6ea-2af4ab505c77","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":564572107,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41710},"address":"10.133.0.28:41710"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01910780-7719-4b9c-b6ea-2af4ab505c77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41722","PortSpecifier":{"PortValue":41722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"02501379-0e56-41a4-900f-3bdedc6e3180","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41722","PortSpecifier":{"PortValue":41722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":576058131},"http":{"id":"02501379-0e56-41a4-900f-3bdedc6e3180","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"02501379-0e56-41a4-900f-3bdedc6e3180"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"02501379-0e56-41a4-900f-3bdedc6e3180","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":576058131,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41722},"address":"10.133.0.28:41722"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"02501379-0e56-41a4-900f-3bdedc6e3180","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41726","PortSpecifier":{"PortValue":41726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41726","PortSpecifier":{"PortValue":41726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":587508151},"http":{"id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":587508151,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41726},"address":"10.133.0.28:41726"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7f79b8a-ed96-4ba9-b1a7-8abb53012511","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41736","PortSpecifier":{"PortValue":41736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1347e929-d54f-4df3-812b-d5732ce739ae","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41736","PortSpecifier":{"PortValue":41736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":599079642},"http":{"id":"1347e929-d54f-4df3-812b-d5732ce739ae","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1347e929-d54f-4df3-812b-d5732ce739ae"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1347e929-d54f-4df3-812b-d5732ce739ae","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":599079642,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41736},"address":"10.133.0.28:41736"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1347e929-d54f-4df3-812b-d5732ce739ae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41744","PortSpecifier":{"PortValue":41744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41744","PortSpecifier":{"PortValue":41744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":630322438},"http":{"id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":630322438,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41744},"address":"10.133.0.28:41744"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e6b069c-7673-4cfe-b4cd-a1c5a47e5e51","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41760","PortSpecifier":{"PortValue":41760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41760","PortSpecifier":{"PortValue":41760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":642354929},"http":{"id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3dafef2b-287a-4604-92fb-a5d3be60a40f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":642354929,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41760},"address":"10.133.0.28:41760"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dafef2b-287a-4604-92fb-a5d3be60a40f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41774","PortSpecifier":{"PortValue":41774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41774","PortSpecifier":{"PortValue":41774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":653824611},"http":{"id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":653824611,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41774},"address":"10.133.0.28:41774"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9cf1e384-d7d2-4c3f-bffb-db986bd0a160","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41782","PortSpecifier":{"PortValue":41782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41782","PortSpecifier":{"PortValue":41782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":665124034},"http":{"id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":665124034,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41782},"address":"10.133.0.28:41782"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e1269c-89ea-4e2d-9c28-558d5f006d83","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41792","PortSpecifier":{"PortValue":41792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41792","PortSpecifier":{"PortValue":41792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":676395283},"http":{"id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"de1ce025-691a-4bb0-adf4-011bce9eafdf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":676395283,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41792},"address":"10.133.0.28:41792"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"de1ce025-691a-4bb0-adf4-011bce9eafdf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41796","PortSpecifier":{"PortValue":41796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41796","PortSpecifier":{"PortValue":41796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":687847823},"http":{"id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":687847823,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41796},"address":"10.133.0.28:41796"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8dd7227f-d221-4baa-ae4c-b8e5dfb2a25d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41802","PortSpecifier":{"PortValue":41802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41802","PortSpecifier":{"PortValue":41802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":699122094},"http":{"id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8f34ef1d-5b87-4570-bd26-6788f31cff24"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":699122094,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41802},"address":"10.133.0.28:41802"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f34ef1d-5b87-4570-bd26-6788f31cff24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41818","PortSpecifier":{"PortValue":41818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a67b751e-bec8-4813-9d4d-596553ab2c55","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41818","PortSpecifier":{"PortValue":41818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":728978736},"http":{"id":"a67b751e-bec8-4813-9d4d-596553ab2c55","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a67b751e-bec8-4813-9d4d-596553ab2c55"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a67b751e-bec8-4813-9d4d-596553ab2c55","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":728978736,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41818},"address":"10.133.0.28:41818"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a67b751e-bec8-4813-9d4d-596553ab2c55","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22246260-032c-4e78-8bfa-c65167d520bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41832","PortSpecifier":{"PortValue":41832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"22246260-032c-4e78-8bfa-c65167d520bd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22246260-032c-4e78-8bfa-c65167d520bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41832","PortSpecifier":{"PortValue":41832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":740847404},"http":{"id":"22246260-032c-4e78-8bfa-c65167d520bd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"22246260-032c-4e78-8bfa-c65167d520bd","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"22246260-032c-4e78-8bfa-c65167d520bd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"22246260-032c-4e78-8bfa-c65167d520bd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":740847404,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41832},"address":"10.133.0.28:41832"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22246260-032c-4e78-8bfa-c65167d520bd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22246260-032c-4e78-8bfa-c65167d520bd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22246260-032c-4e78-8bfa-c65167d520bd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41836","PortSpecifier":{"PortValue":41836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41836","PortSpecifier":{"PortValue":41836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":752627685},"http":{"id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":752627685,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41836},"address":"10.133.0.28:41836"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0bb6057-ec46-48a8-b1fe-8065cf845d6b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41846","PortSpecifier":{"PortValue":41846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41846","PortSpecifier":{"PortValue":41846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":764655687},"http":{"id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"984eafd2-a92a-4724-a805-2dbdee18c9a1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":764655687,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41846},"address":"10.133.0.28:41846"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"984eafd2-a92a-4724-a805-2dbdee18c9a1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41858","PortSpecifier":{"PortValue":41858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41858","PortSpecifier":{"PortValue":41858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":776288572},"http":{"id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":776288572,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41858},"address":"10.133.0.28:41858"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c73c575-cdfa-4b97-a376-0c25225ca4b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41874","PortSpecifier":{"PortValue":41874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cee58aaa-4b80-4216-9634-fa198c475a9e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41874","PortSpecifier":{"PortValue":41874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":787867140},"http":{"id":"cee58aaa-4b80-4216-9634-fa198c475a9e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cee58aaa-4b80-4216-9634-fa198c475a9e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cee58aaa-4b80-4216-9634-fa198c475a9e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":787867140,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41874},"address":"10.133.0.28:41874"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cee58aaa-4b80-4216-9634-fa198c475a9e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41878","PortSpecifier":{"PortValue":41878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41878","PortSpecifier":{"PortValue":41878}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":798775975},"http":{"id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"071331c8-f4d4-49cb-839a-7f0be2fa2892"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":798775975,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41878},"address":"10.133.0.28:41878"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"071331c8-f4d4-49cb-839a-7f0be2fa2892","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41886","PortSpecifier":{"PortValue":41886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41886","PortSpecifier":{"PortValue":41886}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":830136568},"http":{"id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":830136568,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41886},"address":"10.133.0.28:41886"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"285ae652-9a86-4a95-a1f9-0b4711c50bf1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41888","PortSpecifier":{"PortValue":41888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8050fe63-2184-410b-86b5-499dc9f444ea","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41888","PortSpecifier":{"PortValue":41888}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":841565162},"http":{"id":"8050fe63-2184-410b-86b5-499dc9f444ea","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8050fe63-2184-410b-86b5-499dc9f444ea"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8050fe63-2184-410b-86b5-499dc9f444ea","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":841565162,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41888},"address":"10.133.0.28:41888"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8050fe63-2184-410b-86b5-499dc9f444ea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41894","PortSpecifier":{"PortValue":41894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41894","PortSpecifier":{"PortValue":41894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":852525850},"http":{"id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f6d8b593-bd3f-46e7-9f77-f57b41898653"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":852525850,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41894},"address":"10.133.0.28:41894"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f6d8b593-bd3f-46e7-9f77-f57b41898653","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41910","PortSpecifier":{"PortValue":41910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41910","PortSpecifier":{"PortValue":41910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":863236924},"http":{"id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3d1ead9c-79ce-4813-94ff-60e780c484d6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":863236924,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41910},"address":"10.133.0.28:41910"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d1ead9c-79ce-4813-94ff-60e780c484d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d95f650-591e-4e01-853e-5d944615664f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41922","PortSpecifier":{"PortValue":41922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d95f650-591e-4e01-853e-5d944615664f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d95f650-591e-4e01-853e-5d944615664f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41922","PortSpecifier":{"PortValue":41922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":874171193},"http":{"id":"2d95f650-591e-4e01-853e-5d944615664f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d95f650-591e-4e01-853e-5d944615664f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d95f650-591e-4e01-853e-5d944615664f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d95f650-591e-4e01-853e-5d944615664f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d95f650-591e-4e01-853e-5d944615664f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2d95f650-591e-4e01-853e-5d944615664f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2d95f650-591e-4e01-853e-5d944615664f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":874171193,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41922},"address":"10.133.0.28:41922"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2d95f650-591e-4e01-853e-5d944615664f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d95f650-591e-4e01-853e-5d944615664f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d95f650-591e-4e01-853e-5d944615664f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"85005073-1552-4461-865e-289f84da0bea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41934","PortSpecifier":{"PortValue":41934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"85005073-1552-4461-865e-289f84da0bea","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"85005073-1552-4461-865e-289f84da0bea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41934","PortSpecifier":{"PortValue":41934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":885692989},"http":{"id":"85005073-1552-4461-865e-289f84da0bea","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"85005073-1552-4461-865e-289f84da0bea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"85005073-1552-4461-865e-289f84da0bea","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"85005073-1552-4461-865e-289f84da0bea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"85005073-1552-4461-865e-289f84da0bea","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"85005073-1552-4461-865e-289f84da0bea"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"85005073-1552-4461-865e-289f84da0bea","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":885692989,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41934},"address":"10.133.0.28:41934"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"85005073-1552-4461-865e-289f84da0bea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"85005073-1552-4461-865e-289f84da0bea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"85005073-1552-4461-865e-289f84da0bea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41938","PortSpecifier":{"PortValue":41938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41938","PortSpecifier":{"PortValue":41938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":897188670},"http":{"id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":897188670,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41938},"address":"10.133.0.28:41938"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5bfc81b2-7994-4a2e-9118-6abef4494b4e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41948","PortSpecifier":{"PortValue":41948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41948","PortSpecifier":{"PortValue":41948}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":929049181},"http":{"id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":929049181,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41948},"address":"10.133.0.28:41948"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8f4d3b7-b5fe-4e7a-8417-dd9a23ed08cd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41962","PortSpecifier":{"PortValue":41962}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41962","PortSpecifier":{"PortValue":41962}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":941381423},"http":{"id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":941381423,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41962},"address":"10.133.0.28:41962"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c7030fad-849c-450a-b2ed-6aed0b5d6b5b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41966","PortSpecifier":{"PortValue":41966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41966","PortSpecifier":{"PortValue":41966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":953411112},"http":{"id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":953411112,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41966},"address":"10.133.0.28:41966"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a0339b9-a30b-4c8f-bfd6-7ad2fef45f65","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41970","PortSpecifier":{"PortValue":41970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41970","PortSpecifier":{"PortValue":41970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":964637721},"http":{"id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3ab364ed-8dc9-43a4-873b-bb3383818c21"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":964637721,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41970},"address":"10.133.0.28:41970"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ab364ed-8dc9-43a4-873b-bb3383818c21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5133f917-04c1-465d-9f89-260ffafdd136","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41982","PortSpecifier":{"PortValue":41982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5133f917-04c1-465d-9f89-260ffafdd136","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5133f917-04c1-465d-9f89-260ffafdd136","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41982","PortSpecifier":{"PortValue":41982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":976106493},"http":{"id":"5133f917-04c1-465d-9f89-260ffafdd136","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5133f917-04c1-465d-9f89-260ffafdd136","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5133f917-04c1-465d-9f89-260ffafdd136","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5133f917-04c1-465d-9f89-260ffafdd136","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5133f917-04c1-465d-9f89-260ffafdd136","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5133f917-04c1-465d-9f89-260ffafdd136"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5133f917-04c1-465d-9f89-260ffafdd136","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":976106493,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41982},"address":"10.133.0.28:41982"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5133f917-04c1-465d-9f89-260ffafdd136","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5133f917-04c1-465d-9f89-260ffafdd136","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5133f917-04c1-465d-9f89-260ffafdd136","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41988","PortSpecifier":{"PortValue":41988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41988","PortSpecifier":{"PortValue":41988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":987335466},"http":{"id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":987335466,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41988},"address":"10.133.0.28:41988"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef43b4f9-a0e5-4463-b89a-1d5ed52222e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41994","PortSpecifier":{"PortValue":41994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ecc9b4cf-938a-405d-8255-5048a0057038","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:41994","PortSpecifier":{"PortValue":41994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893577,"nanos":998871716},"http":{"id":"ecc9b4cf-938a-405d-8255-5048a0057038","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ecc9b4cf-938a-405d-8255-5048a0057038"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ecc9b4cf-938a-405d-8255-5048a0057038","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":998871716,"seconds":1783893577}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":41994},"address":"10.133.0.28:41994"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecc9b4cf-938a-405d-8255-5048a0057038","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42000","PortSpecifier":{"PortValue":42000}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ddef99a1-b283-4b41-8064-d862f7a782a7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42000","PortSpecifier":{"PortValue":42000}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":31796838},"http":{"id":"ddef99a1-b283-4b41-8064-d862f7a782a7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ddef99a1-b283-4b41-8064-d862f7a782a7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ddef99a1-b283-4b41-8064-d862f7a782a7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":31796838,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42000},"address":"10.133.0.28:42000"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddef99a1-b283-4b41-8064-d862f7a782a7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42014","PortSpecifier":{"PortValue":42014}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42014","PortSpecifier":{"PortValue":42014}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":43197648},"http":{"id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":43197648,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42014},"address":"10.133.0.28:42014"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8905e1f7-1fb9-4458-98bc-a5965aee9dfd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42024","PortSpecifier":{"PortValue":42024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65187923-c2d5-4126-944d-0d452f6d8b89","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42024","PortSpecifier":{"PortValue":42024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":54482683},"http":{"id":"65187923-c2d5-4126-944d-0d452f6d8b89","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"65187923-c2d5-4126-944d-0d452f6d8b89"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"65187923-c2d5-4126-944d-0d452f6d8b89","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":54482683,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42024},"address":"10.133.0.28:42024"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65187923-c2d5-4126-944d-0d452f6d8b89","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42036","PortSpecifier":{"PortValue":42036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42036","PortSpecifier":{"PortValue":42036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":66195381},"http":{"id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"54b87183-bfdc-4627-a020-fc2ee7e124b8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":66195381,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42036},"address":"10.133.0.28:42036"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54b87183-bfdc-4627-a020-fc2ee7e124b8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42042","PortSpecifier":{"PortValue":42042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42042","PortSpecifier":{"PortValue":42042}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":77873936},"http":{"id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"eb463972-77b4-4362-ad1e-ebb58d6d64da"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":77873936,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42042},"address":"10.133.0.28:42042"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb463972-77b4-4362-ad1e-ebb58d6d64da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42044","PortSpecifier":{"PortValue":42044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42044","PortSpecifier":{"PortValue":42044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":89856028},"http":{"id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":89856028,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42044},"address":"10.133.0.28:42044"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76af4c9d-eca0-4fdd-9210-42e23fa0c7f9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42058","PortSpecifier":{"PortValue":42058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42058","PortSpecifier":{"PortValue":42058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":101743317},"http":{"id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":101743317,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42058},"address":"10.133.0.28:42058"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32ceaa5f-be8e-4bc4-969f-13224f3d2dee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42072","PortSpecifier":{"PortValue":42072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42072","PortSpecifier":{"PortValue":42072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":113184677},"http":{"id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"648a4c8a-4049-456d-a7e7-dfe405b56e95"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":113184677,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42072},"address":"10.133.0.28:42072"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"648a4c8a-4049-456d-a7e7-dfe405b56e95","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42084","PortSpecifier":{"PortValue":42084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42084","PortSpecifier":{"PortValue":42084}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":135845826},"http":{"id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":135845826,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42084},"address":"10.133.0.28:42084"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"741bdf46-1faf-42a6-92d3-81fceeab8b5f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42092","PortSpecifier":{"PortValue":42092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42092","PortSpecifier":{"PortValue":42092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":147591101},"http":{"id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a2231df8-1e2f-4e99-b671-833d8983f3e8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":147591101,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42092},"address":"10.133.0.28:42092"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2231df8-1e2f-4e99-b671-833d8983f3e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42102","PortSpecifier":{"PortValue":42102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42102","PortSpecifier":{"PortValue":42102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":159324634},"http":{"id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":159324634,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42102},"address":"10.133.0.28:42102"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8682ee8-6c18-4b82-ae75-bee7d23bfad5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a671f55-d869-47e0-9086-caff52a295b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42114","PortSpecifier":{"PortValue":42114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a671f55-d869-47e0-9086-caff52a295b0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a671f55-d869-47e0-9086-caff52a295b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42114","PortSpecifier":{"PortValue":42114}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":170850730},"http":{"id":"1a671f55-d869-47e0-9086-caff52a295b0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a671f55-d869-47e0-9086-caff52a295b0","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1a671f55-d869-47e0-9086-caff52a295b0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1a671f55-d869-47e0-9086-caff52a295b0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":170850730,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42114},"address":"10.133.0.28:42114"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a671f55-d869-47e0-9086-caff52a295b0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a671f55-d869-47e0-9086-caff52a295b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a671f55-d869-47e0-9086-caff52a295b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42122","PortSpecifier":{"PortValue":42122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42122","PortSpecifier":{"PortValue":42122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":182059621},"http":{"id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":182059621,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42122},"address":"10.133.0.28:42122"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"375b5c62-b6ed-40ce-a9c6-4977ee11635e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42128","PortSpecifier":{"PortValue":42128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42128","PortSpecifier":{"PortValue":42128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":193750532},"http":{"id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":193750532,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42128},"address":"10.133.0.28:42128"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5d7cf95-a53b-4efa-b3f7-a20fc28ec6a7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42140","PortSpecifier":{"PortValue":42140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"60302d3b-7932-92ff-a10e-fbb52e22f801","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42140","PortSpecifier":{"PortValue":42140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":205235702},"http":{"id":"60302d3b-7932-92ff-a10e-fbb52e22f801","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"60302d3b-7932-92ff-a10e-fbb52e22f801"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"60302d3b-7932-92ff-a10e-fbb52e22f801","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":205235702,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42140},"address":"10.133.0.28:42140"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60302d3b-7932-92ff-a10e-fbb52e22f801","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42156","PortSpecifier":{"PortValue":42156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42156","PortSpecifier":{"PortValue":42156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":236153443},"http":{"id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":236153443,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42156},"address":"10.133.0.28:42156"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c68a21c9-e77b-4a04-aecd-8987f6f88a19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42166","PortSpecifier":{"PortValue":42166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42166","PortSpecifier":{"PortValue":42166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":248665987},"http":{"id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":248665987,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42166},"address":"10.133.0.28:42166"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f8801f86-6cbf-4158-8e8b-33c4fe97b2fe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42176","PortSpecifier":{"PortValue":42176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"772a78e6-782b-4201-a0e9-b3c14af613bd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42176","PortSpecifier":{"PortValue":42176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":261083918},"http":{"id":"772a78e6-782b-4201-a0e9-b3c14af613bd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"772a78e6-782b-4201-a0e9-b3c14af613bd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"772a78e6-782b-4201-a0e9-b3c14af613bd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":261083918,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42176},"address":"10.133.0.28:42176"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"772a78e6-782b-4201-a0e9-b3c14af613bd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42180","PortSpecifier":{"PortValue":42180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42180","PortSpecifier":{"PortValue":42180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":272905099},"http":{"id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1615e2ee-c416-4e15-85b8-41a2201f5d71"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":272905099,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42180},"address":"10.133.0.28:42180"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1615e2ee-c416-4e15-85b8-41a2201f5d71","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42188","PortSpecifier":{"PortValue":42188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d537b13f-139a-4422-9e0f-042f79e9a976","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42188","PortSpecifier":{"PortValue":42188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":284600569},"http":{"id":"d537b13f-139a-4422-9e0f-042f79e9a976","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d537b13f-139a-4422-9e0f-042f79e9a976"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d537b13f-139a-4422-9e0f-042f79e9a976","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":284600569,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42188},"address":"10.133.0.28:42188"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d537b13f-139a-4422-9e0f-042f79e9a976","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42190","PortSpecifier":{"PortValue":42190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42190","PortSpecifier":{"PortValue":42190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":296491076},"http":{"id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":296491076,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42190},"address":"10.133.0.28:42190"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f555e9b5-51d8-4fd9-8a94-276f57fee04a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42196","PortSpecifier":{"PortValue":42196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42196","PortSpecifier":{"PortValue":42196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":307993806},"http":{"id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":307993806,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42196},"address":"10.133.0.28:42196"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6f904fdf-1022-4fc4-a5b4-6a52a1d61555","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42206","PortSpecifier":{"PortValue":42206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ba040f9a-27b1-4588-98de-4577d83b2151","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42206","PortSpecifier":{"PortValue":42206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":330865914},"http":{"id":"ba040f9a-27b1-4588-98de-4577d83b2151","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ba040f9a-27b1-4588-98de-4577d83b2151"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ba040f9a-27b1-4588-98de-4577d83b2151","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":330865914,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42206},"address":"10.133.0.28:42206"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ba040f9a-27b1-4588-98de-4577d83b2151","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42208","PortSpecifier":{"PortValue":42208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42208","PortSpecifier":{"PortValue":42208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":342747200},"http":{"id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"756d06ff-2ab8-44cc-9e3d-0d04160af864"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":342747200,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42208},"address":"10.133.0.28:42208"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"756d06ff-2ab8-44cc-9e3d-0d04160af864","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42220","PortSpecifier":{"PortValue":42220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42220","PortSpecifier":{"PortValue":42220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":354237184},"http":{"id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"608578c1-c7f8-4e5a-9124-f31e61056fc5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":354237184,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42220},"address":"10.133.0.28:42220"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"608578c1-c7f8-4e5a-9124-f31e61056fc5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42232","PortSpecifier":{"PortValue":42232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c1873492-620a-481c-8ef4-b76b82e72b85","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42232","PortSpecifier":{"PortValue":42232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":366160697},"http":{"id":"c1873492-620a-481c-8ef4-b76b82e72b85","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c1873492-620a-481c-8ef4-b76b82e72b85"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c1873492-620a-481c-8ef4-b76b82e72b85","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":366160697,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42232},"address":"10.133.0.28:42232"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c1873492-620a-481c-8ef4-b76b82e72b85","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42240","PortSpecifier":{"PortValue":42240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42240","PortSpecifier":{"PortValue":42240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":377447665},"http":{"id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":377447665,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42240},"address":"10.133.0.28:42240"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6fa0e51-c25f-4225-be1e-ee0dd02a11c3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42244","PortSpecifier":{"PortValue":42244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4460b4b8-b784-464c-8b03-f1b5f519be16","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42244","PortSpecifier":{"PortValue":42244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":388934566},"http":{"id":"4460b4b8-b784-464c-8b03-f1b5f519be16","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4460b4b8-b784-464c-8b03-f1b5f519be16"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4460b4b8-b784-464c-8b03-f1b5f519be16","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":388934566,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42244},"address":"10.133.0.28:42244"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4460b4b8-b784-464c-8b03-f1b5f519be16","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42252","PortSpecifier":{"PortValue":42252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42252","PortSpecifier":{"PortValue":42252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":400670364},"http":{"id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":400670364,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42252},"address":"10.133.0.28:42252"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9e3b97c-855b-4bd4-8fcb-3671618daa5e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"187efb16-74a5-43af-967e-800a434bc0e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42254","PortSpecifier":{"PortValue":42254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"187efb16-74a5-43af-967e-800a434bc0e7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"187efb16-74a5-43af-967e-800a434bc0e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42254","PortSpecifier":{"PortValue":42254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":431915433},"http":{"id":"187efb16-74a5-43af-967e-800a434bc0e7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"187efb16-74a5-43af-967e-800a434bc0e7","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"187efb16-74a5-43af-967e-800a434bc0e7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"187efb16-74a5-43af-967e-800a434bc0e7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":431915433,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42254},"address":"10.133.0.28:42254"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"187efb16-74a5-43af-967e-800a434bc0e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"187efb16-74a5-43af-967e-800a434bc0e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"187efb16-74a5-43af-967e-800a434bc0e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42268","PortSpecifier":{"PortValue":42268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42268","PortSpecifier":{"PortValue":42268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":444483279},"http":{"id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":444483279,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42268},"address":"10.133.0.28:42268"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffbf5b7f-1bf0-4162-b168-7be9c9a9daeb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42270","PortSpecifier":{"PortValue":42270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"093f6abb-18f8-4307-b901-9628e79faf2d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42270","PortSpecifier":{"PortValue":42270}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":456268056},"http":{"id":"093f6abb-18f8-4307-b901-9628e79faf2d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"093f6abb-18f8-4307-b901-9628e79faf2d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"093f6abb-18f8-4307-b901-9628e79faf2d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":456268056,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42270},"address":"10.133.0.28:42270"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"093f6abb-18f8-4307-b901-9628e79faf2d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42284","PortSpecifier":{"PortValue":42284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"92460977-7a1d-44e3-b79f-00359d5652b3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42284","PortSpecifier":{"PortValue":42284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":468427295},"http":{"id":"92460977-7a1d-44e3-b79f-00359d5652b3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"92460977-7a1d-44e3-b79f-00359d5652b3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"92460977-7a1d-44e3-b79f-00359d5652b3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":468427295,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42284},"address":"10.133.0.28:42284"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92460977-7a1d-44e3-b79f-00359d5652b3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42296","PortSpecifier":{"PortValue":42296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1455f513-5ce3-4587-8376-f9c9324302a9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42296","PortSpecifier":{"PortValue":42296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":480006632},"http":{"id":"1455f513-5ce3-4587-8376-f9c9324302a9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1455f513-5ce3-4587-8376-f9c9324302a9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1455f513-5ce3-4587-8376-f9c9324302a9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":480006632,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42296},"address":"10.133.0.28:42296"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1455f513-5ce3-4587-8376-f9c9324302a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42308","PortSpecifier":{"PortValue":42308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42308","PortSpecifier":{"PortValue":42308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":491654071},"http":{"id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ec5e845c-333e-4829-8d8b-33999b4aea7f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":491654071,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42308},"address":"10.133.0.28:42308"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5e845c-333e-4829-8d8b-33999b4aea7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42324","PortSpecifier":{"PortValue":42324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42324","PortSpecifier":{"PortValue":42324}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":529719767},"http":{"id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":529719767,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42324},"address":"10.133.0.28:42324"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e738d97e-9ac2-4fbe-bf2f-b4a5931d1030","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42340","PortSpecifier":{"PortValue":42340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42340","PortSpecifier":{"PortValue":42340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":541568143},"http":{"id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":541568143,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42340},"address":"10.133.0.28:42340"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61a8ca1e-eae7-4814-81b4-3c75fa3f22a4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42344","PortSpecifier":{"PortValue":42344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aa34a000-7013-452a-8495-05445bd8d7d7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42344","PortSpecifier":{"PortValue":42344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":553626568},"http":{"id":"aa34a000-7013-452a-8495-05445bd8d7d7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"aa34a000-7013-452a-8495-05445bd8d7d7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"aa34a000-7013-452a-8495-05445bd8d7d7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":553626568,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42344},"address":"10.133.0.28:42344"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa34a000-7013-452a-8495-05445bd8d7d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42358","PortSpecifier":{"PortValue":42358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42358","PortSpecifier":{"PortValue":42358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":565400617},"http":{"id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":565400617,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42358},"address":"10.133.0.28:42358"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43e7f2bb-cd42-4860-b2fd-fb68a23d5a12","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42362","PortSpecifier":{"PortValue":42362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42362","PortSpecifier":{"PortValue":42362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":576721261},"http":{"id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"786861c9-d86f-4939-a8f0-f0936ffe6edc"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":576721261,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42362},"address":"10.133.0.28:42362"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"786861c9-d86f-4939-a8f0-f0936ffe6edc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42364","PortSpecifier":{"PortValue":42364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42364","PortSpecifier":{"PortValue":42364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":588079713},"http":{"id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":588079713,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42364},"address":"10.133.0.28:42364"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8648c0e-1c77-4b66-9dbd-32eb323d81b2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42366","PortSpecifier":{"PortValue":42366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42366","PortSpecifier":{"PortValue":42366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":599363347},"http":{"id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1bb94749-b9e4-465d-864a-f04c9b38c32b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":599363347,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42366},"address":"10.133.0.28:42366"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1bb94749-b9e4-465d-864a-f04c9b38c32b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42374","PortSpecifier":{"PortValue":42374}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42374","PortSpecifier":{"PortValue":42374}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":630955934},"http":{"id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":630955934,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42374},"address":"10.133.0.28:42374"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82228a7c-d2a8-4f6b-ae77-0fad607c5c09","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42380","PortSpecifier":{"PortValue":42380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42380","PortSpecifier":{"PortValue":42380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":642490503},"http":{"id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":642490503,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42380},"address":"10.133.0.28:42380"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1ae8486-a901-4f1b-9c87-06c9d0f56047","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42394","PortSpecifier":{"PortValue":42394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42394","PortSpecifier":{"PortValue":42394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":654103326},"http":{"id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dacc8651-93d4-40ea-abd7-2752470ca0d8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":654103326,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42394},"address":"10.133.0.28:42394"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dacc8651-93d4-40ea-abd7-2752470ca0d8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8eb620b-9722-4008-9b12-a291212ba834","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42402","PortSpecifier":{"PortValue":42402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c8eb620b-9722-4008-9b12-a291212ba834","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8eb620b-9722-4008-9b12-a291212ba834","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42402","PortSpecifier":{"PortValue":42402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":665611616},"http":{"id":"c8eb620b-9722-4008-9b12-a291212ba834","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c8eb620b-9722-4008-9b12-a291212ba834","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c8eb620b-9722-4008-9b12-a291212ba834","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c8eb620b-9722-4008-9b12-a291212ba834","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c8eb620b-9722-4008-9b12-a291212ba834","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c8eb620b-9722-4008-9b12-a291212ba834"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c8eb620b-9722-4008-9b12-a291212ba834","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":665611616,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42402},"address":"10.133.0.28:42402"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c8eb620b-9722-4008-9b12-a291212ba834","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8eb620b-9722-4008-9b12-a291212ba834","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8eb620b-9722-4008-9b12-a291212ba834","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42406","PortSpecifier":{"PortValue":42406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42406","PortSpecifier":{"PortValue":42406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":677746963},"http":{"id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":677746963,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42406},"address":"10.133.0.28:42406"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0e5640b-5a98-4d8e-8d71-ed3297139ebf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42408","PortSpecifier":{"PortValue":42408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cbffe65-919b-47f7-bf0d-688d6f657969","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42408","PortSpecifier":{"PortValue":42408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":689536620},"http":{"id":"0cbffe65-919b-47f7-bf0d-688d6f657969","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0cbffe65-919b-47f7-bf0d-688d6f657969"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0cbffe65-919b-47f7-bf0d-688d6f657969","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":689536620,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42408},"address":"10.133.0.28:42408"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cbffe65-919b-47f7-bf0d-688d6f657969","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42410","PortSpecifier":{"PortValue":42410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9746a7f9-48d7-4b21-a32a-848229738bae","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42410","PortSpecifier":{"PortValue":42410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":701431730},"http":{"id":"9746a7f9-48d7-4b21-a32a-848229738bae","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9746a7f9-48d7-4b21-a32a-848229738bae"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9746a7f9-48d7-4b21-a32a-848229738bae","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":701431730,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42410},"address":"10.133.0.28:42410"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9746a7f9-48d7-4b21-a32a-848229738bae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42426","PortSpecifier":{"PortValue":42426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cbc45861-cf11-4e64-afd6-6110a4988380","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42426","PortSpecifier":{"PortValue":42426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":730143326},"http":{"id":"cbc45861-cf11-4e64-afd6-6110a4988380","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cbc45861-cf11-4e64-afd6-6110a4988380"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cbc45861-cf11-4e64-afd6-6110a4988380","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":730143326,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42426},"address":"10.133.0.28:42426"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbc45861-cf11-4e64-afd6-6110a4988380","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42438","PortSpecifier":{"PortValue":42438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42438","PortSpecifier":{"PortValue":42438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":741769617},"http":{"id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":741769617,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42438},"address":"10.133.0.28:42438"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4db34bd-ec59-4165-a663-0eaaa03ca8a6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42440","PortSpecifier":{"PortValue":42440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6deff972-9a9d-4233-9fbb-2e869f208e45","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42440","PortSpecifier":{"PortValue":42440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":754170101},"http":{"id":"6deff972-9a9d-4233-9fbb-2e869f208e45","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6deff972-9a9d-4233-9fbb-2e869f208e45"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6deff972-9a9d-4233-9fbb-2e869f208e45","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":754170101,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42440},"address":"10.133.0.28:42440"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6deff972-9a9d-4233-9fbb-2e869f208e45","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42450","PortSpecifier":{"PortValue":42450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42450","PortSpecifier":{"PortValue":42450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":766888923},"http":{"id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2bacdc35-18ed-4c96-9a33-cdf534579f62"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":766888923,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42450},"address":"10.133.0.28:42450"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bacdc35-18ed-4c96-9a33-cdf534579f62","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42466","PortSpecifier":{"PortValue":42466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42466","PortSpecifier":{"PortValue":42466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":780339686},"http":{"id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":780339686,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42466},"address":"10.133.0.28:42466"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2fc79e95-3c0e-4ef2-9b85-61187d51372d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42474","PortSpecifier":{"PortValue":42474}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5079739d-261c-4af8-8421-c9e6af9f3d59","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42474","PortSpecifier":{"PortValue":42474}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":791831565},"http":{"id":"5079739d-261c-4af8-8421-c9e6af9f3d59","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5079739d-261c-4af8-8421-c9e6af9f3d59"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5079739d-261c-4af8-8421-c9e6af9f3d59","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":791831565,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42474},"address":"10.133.0.28:42474"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5079739d-261c-4af8-8421-c9e6af9f3d59","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42478","PortSpecifier":{"PortValue":42478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42478","PortSpecifier":{"PortValue":42478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":829087225},"http":{"id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":829087225,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42478},"address":"10.133.0.28:42478"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6aaf0ec-1011-4f78-9729-1482cc953a7e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42488","PortSpecifier":{"PortValue":42488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30cda268-cbd6-4f94-bf75-397bf32015ca","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42488","PortSpecifier":{"PortValue":42488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":840997250},"http":{"id":"30cda268-cbd6-4f94-bf75-397bf32015ca","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"30cda268-cbd6-4f94-bf75-397bf32015ca"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"30cda268-cbd6-4f94-bf75-397bf32015ca","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":840997250,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42488},"address":"10.133.0.28:42488"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42492","PortSpecifier":{"PortValue":42492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42492","PortSpecifier":{"PortValue":42492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":852281936},"http":{"id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"eb628b39-8b62-4c32-a058-a712fe4f7f82"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":852281936,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42492},"address":"10.133.0.28:42492"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2614bd22-b727-4447-8376-12f915ac5169","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42500","PortSpecifier":{"PortValue":42500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2614bd22-b727-4447-8376-12f915ac5169","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2614bd22-b727-4447-8376-12f915ac5169","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42500","PortSpecifier":{"PortValue":42500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":863740430},"http":{"id":"2614bd22-b727-4447-8376-12f915ac5169","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2614bd22-b727-4447-8376-12f915ac5169","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2614bd22-b727-4447-8376-12f915ac5169"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2614bd22-b727-4447-8376-12f915ac5169","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":863740430,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42500},"address":"10.133.0.28:42500"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2614bd22-b727-4447-8376-12f915ac5169","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2614bd22-b727-4447-8376-12f915ac5169","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42506","PortSpecifier":{"PortValue":42506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42506","PortSpecifier":{"PortValue":42506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":875641799},"http":{"id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b2c3eeb1-718b-4987-bbc4-56995cb54661"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":875641799,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42506},"address":"10.133.0.28:42506"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42522","PortSpecifier":{"PortValue":42522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42522","PortSpecifier":{"PortValue":42522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":887044077},"http":{"id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3db1a879-27cf-4c99-8bc1-1705ef09266d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":887044077,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42522},"address":"10.133.0.28:42522"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42532","PortSpecifier":{"PortValue":42532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57a920b8-dd0c-4f8a-9379-4151527ac144","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42532","PortSpecifier":{"PortValue":42532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":898295306},"http":{"id":"57a920b8-dd0c-4f8a-9379-4151527ac144","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"57a920b8-dd0c-4f8a-9379-4151527ac144"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"57a920b8-dd0c-4f8a-9379-4151527ac144","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":898295306,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42532},"address":"10.133.0.28:42532"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42546","PortSpecifier":{"PortValue":42546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42546","PortSpecifier":{"PortValue":42546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":926647962},"http":{"id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":926647962,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42546},"address":"10.133.0.28:42546"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42550","PortSpecifier":{"PortValue":42550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42550","PortSpecifier":{"PortValue":42550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":938754859},"http":{"id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":938754859,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42550},"address":"10.133.0.28:42550"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42566","PortSpecifier":{"PortValue":42566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa450b4c-2002-4411-b938-a20cb48828ba","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42566","PortSpecifier":{"PortValue":42566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":950435400},"http":{"id":"fa450b4c-2002-4411-b938-a20cb48828ba","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fa450b4c-2002-4411-b938-a20cb48828ba"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fa450b4c-2002-4411-b938-a20cb48828ba","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":950435400,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42566},"address":"10.133.0.28:42566"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42582","PortSpecifier":{"PortValue":42582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c20c2db-3134-4d86-9a16-e0920f636326","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42582","PortSpecifier":{"PortValue":42582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":962587115},"http":{"id":"3c20c2db-3134-4d86-9a16-e0920f636326","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3c20c2db-3134-4d86-9a16-e0920f636326"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3c20c2db-3134-4d86-9a16-e0920f636326","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":962587115,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42582},"address":"10.133.0.28:42582"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42592","PortSpecifier":{"PortValue":42592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42592","PortSpecifier":{"PortValue":42592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":973953342},"http":{"id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":973953342,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42592},"address":"10.133.0.28:42592"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42604","PortSpecifier":{"PortValue":42604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42604","PortSpecifier":{"PortValue":42604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":985626368},"http":{"id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":985626368,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42604},"address":"10.133.0.28:42604"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42618","PortSpecifier":{"PortValue":42618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42618","PortSpecifier":{"PortValue":42618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":997370315},"http":{"id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":997370315,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42618},"address":"10.133.0.28:42618"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42634","PortSpecifier":{"PortValue":42634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42634","PortSpecifier":{"PortValue":42634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":30767530},"http":{"id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":30767530,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42634},"address":"10.133.0.28:42634"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42638","PortSpecifier":{"PortValue":42638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42638","PortSpecifier":{"PortValue":42638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":42732783},"http":{"id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a1a335fb-7765-466e-8678-c8ecbe2e9949"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":42732783,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42638},"address":"10.133.0.28:42638"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42644","PortSpecifier":{"PortValue":42644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42644","PortSpecifier":{"PortValue":42644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":54068627},"http":{"id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":54068627,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42644},"address":"10.133.0.28:42644"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42654","PortSpecifier":{"PortValue":42654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68fa122e-42ae-4944-b449-879ab1af49f4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42654","PortSpecifier":{"PortValue":42654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":65413926},"http":{"id":"68fa122e-42ae-4944-b449-879ab1af49f4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"68fa122e-42ae-4944-b449-879ab1af49f4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"68fa122e-42ae-4944-b449-879ab1af49f4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":65413926,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42654},"address":"10.133.0.28:42654"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42658","PortSpecifier":{"PortValue":42658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42658","PortSpecifier":{"PortValue":42658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":77634083},"http":{"id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e430e699-2a8a-9924-bd00-03fcb9877fbc"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":77634083,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42658},"address":"10.133.0.28:42658"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42660","PortSpecifier":{"PortValue":42660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3e989cec-c07b-411a-9e73-01b8d09b4655","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42660","PortSpecifier":{"PortValue":42660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":89257765},"http":{"id":"3e989cec-c07b-411a-9e73-01b8d09b4655","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3e989cec-c07b-411a-9e73-01b8d09b4655"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3e989cec-c07b-411a-9e73-01b8d09b4655","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":89257765,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42660},"address":"10.133.0.28:42660"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42674","PortSpecifier":{"PortValue":42674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0344e469-0e0f-416e-9f19-2fd648984e9f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42674","PortSpecifier":{"PortValue":42674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":130480997},"http":{"id":"0344e469-0e0f-416e-9f19-2fd648984e9f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0344e469-0e0f-416e-9f19-2fd648984e9f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0344e469-0e0f-416e-9f19-2fd648984e9f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":130480997,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42674},"address":"10.133.0.28:42674"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42684","PortSpecifier":{"PortValue":42684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42684","PortSpecifier":{"PortValue":42684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":142187065},"http":{"id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":142187065,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42684},"address":"10.133.0.28:42684"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42690","PortSpecifier":{"PortValue":42690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42690","PortSpecifier":{"PortValue":42690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":154374642},"http":{"id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":154374642,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42690},"address":"10.133.0.28:42690"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42694","PortSpecifier":{"PortValue":42694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42694","PortSpecifier":{"PortValue":42694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":166175281},"http":{"id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"24f12ede-cf2f-4fba-9608-e4be51b1c444"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":166175281,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42694},"address":"10.133.0.28:42694"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a87d0681-bc40-4945-9479-849fd44b086d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42708","PortSpecifier":{"PortValue":42708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a87d0681-bc40-4945-9479-849fd44b086d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a87d0681-bc40-4945-9479-849fd44b086d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42708","PortSpecifier":{"PortValue":42708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":177617636},"http":{"id":"a87d0681-bc40-4945-9479-849fd44b086d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a87d0681-bc40-4945-9479-849fd44b086d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a87d0681-bc40-4945-9479-849fd44b086d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a87d0681-bc40-4945-9479-849fd44b086d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":177617636,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42708},"address":"10.133.0.28:42708"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a87d0681-bc40-4945-9479-849fd44b086d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a87d0681-bc40-4945-9479-849fd44b086d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b919bb3d-fd43-4192-a199-c4310882872e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42720","PortSpecifier":{"PortValue":42720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b919bb3d-fd43-4192-a199-c4310882872e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b919bb3d-fd43-4192-a199-c4310882872e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42720","PortSpecifier":{"PortValue":42720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":189145216},"http":{"id":"b919bb3d-fd43-4192-a199-c4310882872e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b919bb3d-fd43-4192-a199-c4310882872e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b919bb3d-fd43-4192-a199-c4310882872e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b919bb3d-fd43-4192-a199-c4310882872e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":189145216,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42720},"address":"10.133.0.28:42720"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b919bb3d-fd43-4192-a199-c4310882872e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b919bb3d-fd43-4192-a199-c4310882872e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42736","PortSpecifier":{"PortValue":42736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42736","PortSpecifier":{"PortValue":42736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":206539711},"http":{"id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":206539711,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42736},"address":"10.133.0.28:42736"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"439bd09a-347a-4123-b197-2e7e32f60941","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42752","PortSpecifier":{"PortValue":42752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"439bd09a-347a-4123-b197-2e7e32f60941","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"439bd09a-347a-4123-b197-2e7e32f60941","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42752","PortSpecifier":{"PortValue":42752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":228557809},"http":{"id":"439bd09a-347a-4123-b197-2e7e32f60941","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"439bd09a-347a-4123-b197-2e7e32f60941","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"439bd09a-347a-4123-b197-2e7e32f60941"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"439bd09a-347a-4123-b197-2e7e32f60941","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":228557809,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42752},"address":"10.133.0.28:42752"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"439bd09a-347a-4123-b197-2e7e32f60941","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"439bd09a-347a-4123-b197-2e7e32f60941","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42768","PortSpecifier":{"PortValue":42768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42768","PortSpecifier":{"PortValue":42768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":240487225},"http":{"id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":240487225,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42768},"address":"10.133.0.28:42768"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42772","PortSpecifier":{"PortValue":42772}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42772","PortSpecifier":{"PortValue":42772}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":252272426},"http":{"id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":252272426,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42772},"address":"10.133.0.28:42772"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42780","PortSpecifier":{"PortValue":42780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42780","PortSpecifier":{"PortValue":42780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":264854043},"http":{"id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":264854043,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42780},"address":"10.133.0.28:42780"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42790","PortSpecifier":{"PortValue":42790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42790","PortSpecifier":{"PortValue":42790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":277202597},"http":{"id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":277202597,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42790},"address":"10.133.0.28:42790"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"266ef1db-4d1b-4587-a16b-91787638318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42796","PortSpecifier":{"PortValue":42796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"266ef1db-4d1b-4587-a16b-91787638318c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"266ef1db-4d1b-4587-a16b-91787638318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42796","PortSpecifier":{"PortValue":42796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":288730194},"http":{"id":"266ef1db-4d1b-4587-a16b-91787638318c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"266ef1db-4d1b-4587-a16b-91787638318c","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"266ef1db-4d1b-4587-a16b-91787638318c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"266ef1db-4d1b-4587-a16b-91787638318c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":288730194,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42796},"address":"10.133.0.28:42796"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"266ef1db-4d1b-4587-a16b-91787638318c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"266ef1db-4d1b-4587-a16b-91787638318c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":330999092},"http":{"id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":330999092,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42806},"address":"10.133.0.28:42806"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42812","PortSpecifier":{"PortValue":42812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42812","PortSpecifier":{"PortValue":42812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":343448106},"http":{"id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":343448106,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42812},"address":"10.133.0.28:42812"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42824","PortSpecifier":{"PortValue":42824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6151af39-0e24-4b2d-878e-a608939af0a5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42824","PortSpecifier":{"PortValue":42824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":355470708},"http":{"id":"6151af39-0e24-4b2d-878e-a608939af0a5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6151af39-0e24-4b2d-878e-a608939af0a5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6151af39-0e24-4b2d-878e-a608939af0a5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":355470708,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42824},"address":"10.133.0.28:42824"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42826","PortSpecifier":{"PortValue":42826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c21b506c-646a-4f65-9231-6c8f32a43c30","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42826","PortSpecifier":{"PortValue":42826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":367863960},"http":{"id":"c21b506c-646a-4f65-9231-6c8f32a43c30","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c21b506c-646a-4f65-9231-6c8f32a43c30"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c21b506c-646a-4f65-9231-6c8f32a43c30","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":367863960,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42826},"address":"10.133.0.28:42826"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42834","PortSpecifier":{"PortValue":42834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42834","PortSpecifier":{"PortValue":42834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":379824746},"http":{"id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":379824746,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42834},"address":"10.133.0.28:42834"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42844","PortSpecifier":{"PortValue":42844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42844","PortSpecifier":{"PortValue":42844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":391819678},"http":{"id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":391819678,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42844},"address":"10.133.0.28:42844"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42852","PortSpecifier":{"PortValue":42852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42852","PortSpecifier":{"PortValue":42852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":430827969},"http":{"id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":430827969,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42852},"address":"10.133.0.28:42852"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42866","PortSpecifier":{"PortValue":42866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42866","PortSpecifier":{"PortValue":42866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":443389934},"http":{"id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":443389934,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42866},"address":"10.133.0.28:42866"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07027361-edee-4f19-8411-4d0f96cec13f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54658","PortSpecifier":{"PortValue":54658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07027361-edee-4f19-8411-4d0f96cec13f","method":"DELETE","path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0","host":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07027361-edee-4f19-8411-4d0f96cec13f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54658","PortSpecifier":{"PortValue":54658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":740265816},"http":{"id":"07027361-edee-4f19-8411-4d0f96cec13f","method":"DELETE","headers":{":authority":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0",":scheme":"https","accept":"*/*","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"07027361-edee-4f19-8411-4d0f96cec13f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:maas-admin:tester-admin-user","uid":"caa59ad8-3595-400c-a0e7-70eb3acb966c","groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=35ee2171-af3d-4970-aece-3cf67240afeb"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/029f74d4e359"]}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07027361-edee-4f19-8411-4d0f96cec13f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/029f74d4e359"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=35ee2171-af3d-4970-aece-3cf67240afeb"]},"groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"uid":"caa59ad8-3595-400c-a0e7-70eb3acb966c","username":"system:serviceaccount:maas-admin:tester-admin-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0",":scheme":"https","accept":"*/*","authorization":"Bearer **** ****REDACTED_JWT****","forwarded":"for=34.228.250.194;host=maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com;proto=https","user-agent":"curl/7.76.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.11","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"34.228.250.194,10.133.0.11","x-forwarded-host":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"07027361-edee-4f19-8411-4d0f96cec13f"},"host":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com","id":"07027361-edee-4f19-8411-4d0f96cec13f","method":"DELETE","path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":740265816,"seconds":1783893579},"url_path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0","user_agent":"curl/7.76.1"},"source":{"address":"10.133.0.11:54658","port":54658}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07027361-edee-4f19-8411-4d0f96cec13f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07027361-edee-4f19-8411-4d0f96cec13f","authorized":true,"response":"OK"}